@webpresso/plugin-opencode 0.0.11 → 0.0.13

package/bin/wp

@@ -0,0 +1,250 @@
+#!/bin/sh
+# webpresso-wp-shim v1 — keep this marker on line 2 (shim loop guard).
+#
+# The one `wp` shim. Copied byte-identically into each plugin's bin/wp
+# (packages/scripts/stage-plugin-runtime-artifacts.ts) and, once the release
+# installer adopts it, into ~/.webpresso/bin/wp. It stores no state, writes
+# nothing, and picks the runtime on EVERY call from where it is called:
+#
+#   1. WEBPRESSO_WP_BIN (an absolute executable)  xor  WP_FORCE_JIT_PATH (an
+#      absolute checkout)
+#   2. the nearest ancestor of $PWD that is a webpresso source checkout
+#      (bin/wp + src/cli/cli.ts) ADMITTED in ~/.webpresso/source-checkouts
+#      -> <checkout>/bin/wp, whose own launcher guards freshness against HEAD.
+#      Layout is not trust: a source-shaped directory whose repository is not
+#      listed there fails with checkout-not-admitted instead of running its
+#      bin/wp. A linked worktree is admitted through its repository, and only
+#      when the admitted repository's own .git/worktrees/*/gitdir names it.
+#   3. else (no checkout ancestor at all) the nearest ancestor
+#      .webpressorc.json: its top-level exact-semver "runtime" pin
+#      -> ~/.webpresso/runtimes/<pin>/wp (missing = error)
+#   4. else the newest stable ~/.webpresso/runtimes/<x.y.z>/wp
+#   5. else a named error, exit 127 — never a different runtime. A pre-shim
+#      ~/.webpresso/bin/wp is never run implicitly (nothing in it proves it is
+#      a release rather than a development build); name it with
+#      WEBPRESSO_WP_BIN.
+#
+# Bounded: a parent-directory walk, one-line reads of the user's admission file
+# and of admitted repositories' worktree back-links, at most one size-capped
+# JSON read (node, only in a consumer repo with a
+# .webpressorc.json), one directory listing. No git, no network, no retries,
+# no timeouts. Mode and error literals
+# are the closed vocabulary in src/runtime/runtime-selector-vocab.ts.
+#
+# `exec`, not a spawn wrapper: the MCP server this launches is a long-lived
+# stdio service, and a relay process could die and orphan it. Arguments are
+# forwarded verbatim through "$@".
+
+set -u
+
+announced_modes='explicit-binary explicit-checkout'
+
+fail() {
+  printf 'wp-shim: error %s: %s\n' "$1" "$2" >&2
+  exit 127
+}
+
+MODE=
+TARGET=
+choose() {
+  MODE=$1
+  TARGET=$2
+}
+
+admission_file=${HOME:-}/.webpresso/source-checkouts
+
+is_source_shaped() {
+  [ -f "$1/bin/wp" ] && [ -x "$1/bin/wp" ] && [ -f "$1/src/cli/cli.ts" ]
+}
+
+# True when checkout $1 is an admitted repository's primary checkout, or one of
+# its registered linked worktrees. The admission file is user-owned, one
+# absolute primary-checkout path per line. Identity is by directory (-ef), and
+# a linked worktree is recognized only from the admitted repository's own
+# .git/worktrees/*/gitdir back-links: nothing inside the project (its .git
+# file, symlink or metadata) is ever read or trusted, and stat never blocks.
+is_admitted_checkout() {
+  [ -f "$admission_file" ] || return 1
+  while IFS= read -r entry || [ -n "$entry" ]; do
+    case $entry in /*) ;; *) continue ;; esac
+    [ "$entry" -ef "$1" ] && return 0
+    for meta in "$entry"/.git/worktrees/*/; do
+      [ -f "${meta}gitdir" ] || continue
+      back=
+      IFS= read -r back <"${meta}gitdir" || [ -n "$back" ] || continue
+      [ "${back%/.git}" -ef "$1" ] && return 0
+    done
+  done <"$admission_file"
+  return 1
+}
+
+# Exact semver x.y.z[-pre], no leading zeros, no build metadata. With a second
+# argument "stable", a prerelease is rejected too.
+is_exact_semver() {
+  version=$1
+  core=${version%%-*}
+  pre=
+  if [ "$core" != "$version" ]; then
+    pre=${version#*-}
+    [ "${2:-}" != stable ] || return 1
+    case $pre in '' | .* | *. | *..* | *[!0-9A-Za-z.-]*) return 1 ;; esac
+    saved_ifs=$IFS
+    IFS=.
+    # shellcheck disable=SC2086 # deliberate field split on "."
+    set -- $pre
+    IFS=$saved_ifs
+    for part in "$@"; do
+      case $part in 0?*) case $part in *[!0-9]*) ;; *) return 1 ;; esac ;; esac
+    done
+  fi
+  case $core in '' | .* | *. | *..* | *[!0-9.]*) return 1 ;; esac
+  saved_ifs=$IFS
+  IFS=.
+  # shellcheck disable=SC2086 # deliberate field split on "."
+  set -- $core
+  IFS=$saved_ifs
+  [ "$#" -eq 3 ] || return 1
+  for part in "$@"; do
+    case $part in '' | 0?* | *[!0-9]*) return 1 ;; esac
+  done
+  return 0
+}
+
+runtimes_dir=${HOME:-}/.webpresso/runtimes
+
+# Sets PIN to the top-level "runtime" of $1 (empty when absent). The document
+# is opened non-blocking, must be a regular file, and is read through a
+# 64 KiB + 1 buffer on that one descriptor (growth after open cannot exceed
+# it); anything longer is refused. The pin
+# is validated as an exact semver BEFORE it crosses back into the shell, so no
+# shell transport (such as a stripped trailing newline) can change it.
+read_pin() {
+  PIN=$(node -e '
+    const fs = require("node:fs");
+    let fd;
+    try { fd = fs.openSync(process.argv[1], fs.constants.O_RDONLY | fs.constants.O_NONBLOCK); } catch { process.exit(2); }
+    if (!fs.fstatSync(fd).isFile()) process.exit(3);
+    const limit = 65536;
+    const buffer = Buffer.alloc(limit + 1);
+    let length = 0;
+    for (let n; length <= limit && (n = fs.readSync(fd, buffer, length, limit + 1 - length, null)) > 0; ) length += n;
+    if (length > limit) process.exit(3);
+    let v;
+    try { v = JSON.parse(buffer.subarray(0, length).toString("utf8")); } catch { process.exit(2); }
+    if (v === null || typeof v !== "object" || Array.isArray(v) || !Object.hasOwn(v, "runtime")) process.exit(0);
+    const pattern = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?$/u;
+    if (typeof v.runtime !== "string" || !pattern.test(v.runtime)) process.exit(4);
+    process.stdout.write(v.runtime);
+  ' "$1" 2>/dev/null)
+  case $? in
+    0) return 0 ;;
+    3) PIN_PROBLEM="is not a regular file of at most 64 KiB" ;;
+    4) PIN_PROBLEM="has a \"runtime\" pin that is not an exact version such as 1.2.3 (no ranges, no build metadata)" ;;
+    127) PIN_PROBLEM="cannot be read: node is not on PATH" ;;
+    *) PIN_PROBLEM="is not valid JSON" ;;
+  esac
+  return 1
+}
+
+choose_latest_release() {
+  best=
+  best_major=
+  best_minor=
+  best_patch=
+  for entry in "$runtimes_dir"/*/; do
+    [ -d "$entry" ] || continue
+    entry=${entry%/}
+    version=${entry##*/}
+    is_exact_semver "$version" stable || continue
+    [ -f "$entry/wp" ] && [ -x "$entry/wp" ] || continue
+    major=${version%%.*}
+    rest=${version#*.}
+    minor=${rest%%.*}
+    patch=${rest#*.}
+    if [ -z "$best" ] ||
+      [ "$major" -gt "$best_major" ] ||
+      { [ "$major" -eq "$best_major" ] && [ "$minor" -gt "$best_minor" ]; } ||
+      { [ "$major" -eq "$best_major" ] && [ "$minor" -eq "$best_minor" ] && [ "$patch" -gt "$best_patch" ]; }; then
+      best=$version
+      best_major=$major
+      best_minor=$minor
+      best_patch=$patch
+    fi
+  done
+  if [ -n "$best" ]; then
+    choose latest-release "$runtimes_dir/$best/wp"
+    return 0
+  fi
+  return 1
+}
+
+is_shim_file() {
+  [ -f "$1" ] || return 1
+  { head -c 256 "$1" | grep -q 'webpresso-wp-shim'; } 2>/dev/null
+}
+
+choose_release() {
+  if [ -n "${1:-}" ]; then
+    rc_file=$1/.webpressorc.json
+    read_pin "$rc_file" || fail pin-invalid "$rc_file $PIN_PROBLEM."
+    if [ -n "$PIN" ]; then
+      is_exact_semver "$PIN" || fail pin-invalid "$rc_file pins runtime \"$PIN\"; use an exact version such as 1.2.3 (no ranges)."
+      pinned=$runtimes_dir/$PIN/wp
+      [ -f "$pinned" ] && [ -x "$pinned" ] || fail pin-not-installed "$rc_file pins runtime $PIN, but $pinned is not installed under $runtimes_dir."
+      choose pinned-release "$pinned"
+      return 0
+    fi
+  fi
+  choose_latest_release && return 0
+  fail no-release-installed "no webpresso source checkout above $PWD and no release under $runtimes_dir; install the Webpresso app, or name a runtime explicitly with WEBPRESSO_WP_BIN (for example a pre-shim \$HOME/.webpresso/bin/wp release) or WP_FORCE_JIT_PATH (a source checkout)."
+}
+
+: "${WEBPRESSO_WP_BIN:=}"
+: "${WP_FORCE_JIT_PATH:=}"
+
+if [ -n "$WEBPRESSO_WP_BIN" ] && [ -n "$WP_FORCE_JIT_PATH" ]; then
+  fail both-overrides-set "WEBPRESSO_WP_BIN and WP_FORCE_JIT_PATH are both set; unset one."
+elif [ -n "$WEBPRESSO_WP_BIN" ]; then
+  case $WEBPRESSO_WP_BIN in /*) ;; *) fail override-missing "WEBPRESSO_WP_BIN must be an absolute path (got $WEBPRESSO_WP_BIN); exec would otherwise search PATH for a different file." ;; esac
+  [ -f "$WEBPRESSO_WP_BIN" ] && [ -x "$WEBPRESSO_WP_BIN" ] || fail override-missing "WEBPRESSO_WP_BIN points to $WEBPRESSO_WP_BIN, which is not an executable file."
+  choose explicit-binary "$WEBPRESSO_WP_BIN"
+elif [ -n "$WP_FORCE_JIT_PATH" ]; then
+  case $WP_FORCE_JIT_PATH in /*) ;; *) fail override-missing "WP_FORCE_JIT_PATH must be an absolute path (got $WP_FORCE_JIT_PATH)." ;; esac
+  is_source_shaped "$WP_FORCE_JIT_PATH" || fail override-missing "WP_FORCE_JIT_PATH points to $WP_FORCE_JIT_PATH, which is not a webpresso source checkout (executable bin/wp and src/cli/cli.ts)."
+  choose explicit-checkout "$WP_FORCE_JIT_PATH/bin/wp"
+else
+  # Checkout first, across every ancestor: a .webpressorc.json nested inside
+  # a source checkout must not pin a foreign runtime there. Only when no
+  # ancestor is a checkout does the nearest consumer config decide.
+  dir=${PWD:-}
+  consumer_root=
+  while [ -n "$dir" ]; do
+    if is_source_shaped "$dir"; then
+      is_admitted_checkout "$dir" || fail checkout-not-admitted "$dir looks like a webpresso source checkout, but its repository is not listed in $admission_file; add the absolute path of its primary checkout there (one per line) to run its bin/wp, or set WP_FORCE_JIT_PATH=$dir for this call."
+      choose checkout "$dir/bin/wp"
+      break
+    fi
+    if [ -z "$consumer_root" ] && [ -e "$dir/.webpressorc.json" ]; then
+      consumer_root=$dir
+    fi
+    [ "$dir" != / ] || break
+    dir=${dir%/*}
+    [ -n "$dir" ] || dir=/
+  done
+  [ -n "$TARGET" ] || choose_release "$consumer_root"
+fi
+
+# Never exec a shim: this one (directly or through a symlink) or another
+# byte-identical plugin copy would recurse instead of reaching a runtime.
+if [ "$TARGET" = "$0" ] || [ "$TARGET" -ef "$0" ] || is_shim_file "$TARGET"; then
+  fail self-reference "$MODE resolved to a wp shim ($TARGET); point it at a wp runtime instead."
+fi
+
+case " $announced_modes " in
+  *" $MODE "*) printf 'wp-shim: %s %s\n' "$MODE" "$TARGET" >&2 ;;
+esac
+
+WP_SKIP_UPDATE_CHECK=${WP_SKIP_UPDATE_CHECK:-1}
+export WP_SKIP_UPDATE_CHECK
+
+exec "$TARGET" "$@"

package/index.js

@@ -1,10 +1,13 @@
+import { spawn } from "node:child_process";
 import { accessSync, constants, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 
 const SESSION_START_HOOKS = ["sessionstart-routing"];
 const PRE_TOOL_HOOKS = ["pretool-guard"];
 const POST_TOOL_HOOKS = ["post-tool"];
+const HOOK_BUDGET_MS = 5_000;
 
 function extractAdditionalContext(envelope) {
   return envelope?.hookSpecificOutput?.additionalContext ?? null;
@@ -24,11 +27,16 @@ function extractUpdatedInput(envelope) {
   return output?.permissionDecision === "allow" ? (output.updatedInput ?? null) : null;
 }
 
-function hookInputForTool(tool, args, directory) {
+function sessionIdFrom(source) {
+  return source?.sessionID ?? source?.sessionId ?? source?.session_id ?? null;
+}
+
+function hookInputForTool(tool, args, directory, sessionId) {
   const toolArgs = args && typeof args === "object" && !Array.isArray(args) ? args : {};
   const base = {
     cwd: directory,
     hook_event_name: "PreToolUse",
+    ...(sessionId ? { session_id: sessionId } : {}),
   };
 
   switch (tool) {
@@ -81,10 +89,6 @@ function hookInputForTool(tool, args, directory) {
   }
 }
 
-function shellQuote(value) {
-  return `'${String(value).replaceAll("'", "'\\''")}'`;
-}
-
 function isExecutableFile(candidate) {
   try {
     const stat = statSync(candidate);
@@ -96,92 +100,137 @@ function isExecutableFile(candidate) {
   }
 }
 
-function fixedAppWpLauncher() {
-  const home =
-    process.platform === "win32"
-      ? process.env.USERPROFILE || homedir()
-      : process.env.HOME || homedir();
-  return process.platform === "win32"
-    ? join(home, ".webpresso", "bin", "wp.exe")
-    : join(home, ".webpresso", "bin", "wp");
-}
+/**
+ * The packaged copy of the canonical `wp` shim (bin/wp-shim). It owns runtime
+ * selection: explicit override, then the enclosing webpresso checkout, then the
+ * consumer's pinned or newest installed release, else a named error.
+ */
+const PACKAGED_WP_SHIM = join(dirname(fileURLToPath(import.meta.url)), "bin", "wp");
 
-async function resolveWpHookCommand($, directory, hookName) {
-  const explicit = process.env.WEBPRESSO_WP_BIN;
-  const jitRoot = process.env.WP_FORCE_JIT_PATH;
-  if (explicit && jitRoot) {
+export function resolveWpLauncher(platform = process.platform, env = process.env) {
+  if (platform !== "win32") return PACKAGED_WP_SHIM;
+  // The shim is POSIX sh. Until a native Windows shim exists, Windows keeps the
+  // explicit overrides (and their conflict refusal) plus the app launcher.
+  if (env.WEBPRESSO_WP_BIN && env.WP_FORCE_JIT_PATH) {
     throw new Error("WEBPRESSO_WP_BIN and WP_FORCE_JIT_PATH are both set; unset one.");
   }
+  if (env.WEBPRESSO_WP_BIN) return env.WEBPRESSO_WP_BIN;
+  if (env.WP_FORCE_JIT_PATH) return join(env.WP_FORCE_JIT_PATH, "bin", "wp");
+  return join(env.USERPROFILE || homedir(), ".webpresso", "bin", "wp.exe");
+}
 
-  let candidate = null;
-  let label = "Webpresso app launcher";
-  if (explicit) {
-    candidate = explicit;
-    label = "WEBPRESSO_WP_BIN";
-  } else if (jitRoot) {
-    candidate = join(jitRoot, "bin", "wp");
-    label = "WP_FORCE_JIT_PATH";
-  } else {
-    candidate = fixedAppWpLauncher();
-  }
-
-  if (!isExecutableFile(candidate)) {
+function resolveWpHookCommand() {
+  const launcher = resolveWpLauncher();
+  if (!isExecutableFile(launcher)) {
     throw new Error(
-      `${label} points to ${candidate}, but that executable is not available. ` +
-        "Set WEBPRESSO_WP_BIN, set WP_FORCE_JIT_PATH to an agent-kit checkout, or install the Webpresso app.",
+      `the webpresso wp launcher ${launcher} is not available; reinstall @webpresso/plugin-opencode or the Webpresso app.`,
     );
   }
-  return `${shellQuote(candidate)} hook ${hookName}`;
+  return launcher;
 }
 
-async function runHook($, directory, hookName, payload, options = {}) {
-  const stdinPayload = payload === null ? "" : JSON.stringify(payload);
-  const command = await resolveWpHookCommand($, directory, hookName);
-  const result =
-    await $`printf '%s' ${stdinPayload} | env CLAUDE_PROJECT_DIR=${directory} WP_HOOK_HOST=opencode sh -lc ${command}`
-      .cwd(directory)
-      .quiet()
-      .nothrow();
+function spawnWpHook(candidate, directory, hookName, stdinPayload) {
+  return new Promise((resolve) => {
+    const child = spawn(candidate, ["hook", hookName], {
+      cwd: directory,
+      env: {
+        ...process.env,
+        CLAUDE_PROJECT_DIR: directory,
+        WP_HOOK_HOST: "opencode",
+      },
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let settled = false;
+    const settle = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      resolve(result);
+    };
+    // Same hard budget every other host declares for webpresso hooks.
+    const deadline = setTimeout(() => {
+      child.kill("SIGKILL");
+      settle({
+        stdout: Buffer.alloc(0),
+        stderr: Buffer.from(`timed out after ${HOOK_BUDGET_MS} ms`),
+        exitCode: null,
+      });
+    }, HOOK_BUDGET_MS);
+    child.stdout.on("data", (chunk) => stdoutChunks.push(Buffer.from(chunk)));
+    child.stderr.on("data", (chunk) => stderrChunks.push(Buffer.from(chunk)));
+    child.on("error", (error) => {
+      settle({ stdout: Buffer.alloc(0), stderr: Buffer.from(error.message), exitCode: null });
+    });
+    child.on("close", (code) => {
+      settle({
+        stdout: Buffer.concat(stdoutChunks),
+        stderr: Buffer.concat(stderrChunks),
+        exitCode: code,
+      });
+    });
+    child.stdin.on("error", () => {});
+    child.stdin.end(stdinPayload);
+  });
+}
 
-  const stdout = result.stdout.toString().trim();
-  const stderr = result.stderr?.toString().trim() ?? "";
-  const exitCode = result.exitCode ?? 0;
-  const required = options.required === true;
+function hookFailure(hookName, detail, cause) {
+  return new Error(
+    `GUARD_PRETOOL_FAILURE: webpresso hook ${hookName} ${detail}`,
+    cause === undefined ? undefined : { cause },
+  );
+}
 
-  if (exitCode !== 0) {
-    if (required) {
-      throw new Error(
-        `webpresso hook ${hookName} failed with exit ${exitCode}${stderr ? `: ${stderr}` : ""}`,
-      );
-    }
+/**
+ * Required hooks (pretool policy) fail closed on every failure mode: launcher
+ * missing, spawn error, timeout, non-zero exit, empty or malformed stdout.
+ * Observational hooks return null instead.
+ */
+async function runHook(directory, hookName, payload, options = {}) {
+  const required = options.required === true;
+  const stdinPayload = payload === null ? "" : JSON.stringify(payload);
+  let candidate;
+  try {
+    candidate = resolveWpHookCommand();
+  } catch (error) {
+    if (required) throw hookFailure(hookName, `cannot start: ${error.message}`, error);
     return null;
   }
+  const result = await spawnWpHook(candidate, directory, hookName, stdinPayload);
+  const stdout = result.stdout.toString().trim();
+  const stderr = result.stderr.toString().trim();
+  const detail = stderr ? `: ${stderr}` : "";
 
+  if (result.exitCode !== 0) {
+    if (!required) return null;
+    throw hookFailure(
+      hookName,
+      result.exitCode === null
+        ? `did not complete${detail}`
+        : `failed with exit ${result.exitCode}${detail}`,
+    );
+  }
   if (stdout === "") {
-    if (required) {
-      throw new Error(`webpresso hook ${hookName} produced no JSON response`);
-    }
+    if (required) throw hookFailure(hookName, "produced no JSON response");
     return null;
   }
-
   try {
     return JSON.parse(stdout);
   } catch (error) {
-    if (required) {
-      throw new Error(
-        `webpresso hook ${hookName} produced invalid JSON${stderr ? `: ${stderr}` : ""}`,
-        { cause: error },
-      );
-    }
+    if (required) throw hookFailure(hookName, `produced invalid JSON${detail}`, error);
     return null;
   }
 }
 
-async function collectSessionStartContext($, directory) {
+async function collectSessionStartContext(directory, sessionId) {
   const contexts = [];
+  const payload = sessionId
+    ? { cwd: directory, hook_event_name: "SessionStart", session_id: sessionId }
+    : null;
 
   for (const hookName of SESSION_START_HOOKS) {
-    const envelope = await runHook($, directory, hookName, null);
+    const envelope = await runHook(directory, hookName, payload);
     const message = extractAdditionalContext(envelope);
     if (message === null) {
       continue;
@@ -193,26 +242,31 @@ async function collectSessionStartContext($, directory) {
   return contexts;
 }
 
-export const WebpressoHooksPlugin = async ({ $, directory }) => {
+export const WebpressoHooksPlugin = async ({ directory }) => {
   let cachedSessionContexts = [];
 
   return {
     event: async ({ event }) => {
       if (event?.type === "session.created") {
-        cachedSessionContexts = await collectSessionStartContext($, directory);
+        cachedSessionContexts = await collectSessionStartContext(directory, sessionIdFrom(event));
       }
     },
     "shell.env": async (input, output) => {
       output.env.CLAUDE_PROJECT_DIR = input.cwd;
     },
     "tool.execute.before": async (input, output) => {
-      const payload = hookInputForTool(input?.tool, output?.args ?? input?.args ?? {}, directory);
+      const payload = hookInputForTool(
+        input?.tool,
+        output?.args ?? input?.args ?? {},
+        directory,
+        sessionIdFrom(input),
+      );
       if (payload === null) {
         return;
       }
 
       for (const hookName of PRE_TOOL_HOOKS) {
-        const envelope = await runHook($, directory, hookName, payload, { required: true });
+        const envelope = await runHook(directory, hookName, payload, { required: true });
         const denyReason = extractDenyReason(envelope);
         if (denyReason !== null) {
           throw new Error(denyReason);
@@ -225,17 +279,22 @@ export const WebpressoHooksPlugin = async ({ $, directory }) => {
       }
     },
     "tool.execute.after": async (input, output) => {
-      const payload = hookInputForTool(input?.tool, output?.args ?? input?.args ?? {}, directory);
+      const payload = hookInputForTool(
+        input?.tool,
+        output?.args ?? input?.args ?? {},
+        directory,
+        sessionIdFrom(input),
+      );
       if (payload === null) {
         return;
       }
 
       for (const hookName of POST_TOOL_HOOKS) {
-        await runHook($, directory, hookName, payload);
+        await runHook(directory, hookName, payload);
       }
     },
     "experimental.session.compacting": async (_input, output) => {
-      cachedSessionContexts = await collectSessionStartContext($, directory);
+      cachedSessionContexts = await collectSessionStartContext(directory);
       if (output && Array.isArray(output.context)) {
         for (const message of cachedSessionContexts) {
           output.context.push(message);
@@ -245,6 +304,9 @@ export const WebpressoHooksPlugin = async ({ $, directory }) => {
   };
 };
 
-const webpressoOpenCodePlugins = [WebpressoHooksPlugin];
+const webpressoOpenCodePlugin = {
+  id: "@webpresso/plugin-opencode",
+  server: WebpressoHooksPlugin,
+};
 
-export default webpressoOpenCodePlugins;
+export default webpressoOpenCodePlugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpresso/plugin-opencode",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "private": false,
   "description": "OpenCode plugin adapter package for Webpresso agent-kit.",
   "homepage": "https://github.com/webpresso/app#readme",
@@ -15,6 +15,7 @@
   },
   "files": [
     "index.js",
+    "bin/wp",
     "plugin-skill-ownership.json",
     "skills/**/SKILL.md",
     "skills/**/references/**",
@@ -29,13 +30,15 @@
   "sideEffects": false,
   "main": "./index.js",
   "exports": {
-    ".": "./index.js"
+    ".": "./index.js",
+    "./server": "./index.js"
   },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
   "engines": {
-    "node": ">=24"
+    "node": ">=24",
+    "opencode": ">=1.18.0"
   }
 }

package/plugin-skill-ownership.json

@@ -2,14 +2,14 @@
   "schemaVersion": 1,
   "host": "opencode",
   "packageName": "@webpresso/plugin-opencode",
-  "packageVersion": "0.0.11",
+  "packageVersion": "0.0.13",
   "runtimeDirs": [],
   "skills": {
     "ai-deslop": {
       "digest": "sha256:cf07df5835037f10401400e220c1c923f5325a6149d59c231ce316e10595fdfc"
     },
     "autopilot": {
-      "digest": "sha256:fc0f77917bd7af3d6e99ce3a96067394308a3b8c94c416b5076167b19e00a754"
+      "digest": "sha256:86610df486eba87af41a5478efd6970312f24ac198a9351de9675649d5ccd75d"
     },
     "autoresearch": {
       "digest": "sha256:b4d51cd53beb4a3271827172dfbd0b1d27bd58761ca07a35d49a5d6324b87fdf"
@@ -21,10 +21,10 @@
       "digest": "sha256:21fd24862e7f7c8a1feadea6bc376492b136b99fc381cf1b8927c9db80615431"
     },
     "claude": {
-      "digest": "sha256:e1e97e5419249fbb0cb8446e96fc8e80c165c149db563784570f96ad629ab54d"
+      "digest": "sha256:0205d693121b740b76041f1e25925a70d665774f7493070cdd6df40d0058ffe6"
     },
     "codex": {
-      "digest": "sha256:1f93db92066e5b39ba334ec1d8c3af3de79dea13947dba97b8b7340302906d63"
+      "digest": "sha256:88837502404449b641b71dbc4f018c75dab6294ad98af29d41de50e98649ff0e"
     },
     "deep-interview": {
       "digest": "sha256:79fbf86a86024a311583a1500bb6960c82ad1383cc9f8ed3f04bbace41848ff7"
@@ -42,10 +42,10 @@
       "digest": "sha256:306355888da0827e3523022077f731845726bbaaf595ca12515cc91d8605b5e6"
     },
     "fix": {
-      "digest": "sha256:38ddebb82a73e9e18e5b9909585a8477285387ac7bbad2574e3708362c4d0475"
+      "digest": "sha256:4804c546291316439aad3ea05fb7d3f043bc191abd8b9c180eb1d349f19f64cf"
     },
     "grok": {
-      "digest": "sha256:1a6bf596fde9ce50a06ea767c06e65d4845c52d5af085644c958964385363b1e"
+      "digest": "sha256:e0093092dd84b7f8dc4aad09f7d1cd5cb104728194a20ef5ed37520e1f53403e"
     },
     "handoff": {
       "digest": "sha256:eb34b39fc6d416fe8203eea979b4b99ab3150c44da6dad3ca4afb8fe8fb75b85"
@@ -60,7 +60,7 @@
       "digest": "sha256:a80fbacc765e8b886437b9fdf7dd71e1ceb1b98b939078ec90fc88d06a8b4c69"
     },
     "opencode-go": {
-      "digest": "sha256:c47cbe07f96510112d1bccae0a6319d3f74a5e2f3827a59865d45aea757c6dc6"
+      "digest": "sha256:3100cf1116402a63bd8bc34b1b544e68a90fe5fb899ebbbdfab73d28200ce379"
     },
     "plan-ceo-review": {
       "digest": "sha256:4d426158518dd71f8998770e8d4037bcbfa3c65d7265a93a4a78a9b015ba881e"
@@ -78,7 +78,7 @@
       "digest": "sha256:cf2c0743a81b0d8954417482e7812212a6a90e5046926c44cd82a6a309dfdc26"
     },
     "ralplan": {
-      "digest": "sha256:47cf47910b50471eb92f9487a018311442c95b26907c5b21c3f5b87947bf7e7e"
+      "digest": "sha256:d3e8ab6285f9882d18ee9feabf51bb6dd9d81f8aaa243c050e9eeaa3436927af"
     },
     "team": {
       "digest": "sha256:c27107b46e0cd7b9c264a6f51f74f505920d63e7ee2a2d26d2f288592fd10bd2"
@@ -90,16 +90,16 @@
       "digest": "sha256:23fdad944b089de3cfcd13957a5ac10c37bd3d136b192029af69368bca1470db"
     },
     "tooling-friction": {
-      "digest": "sha256:569904882036df09b52864411332ad5ea53e2914bc58d90030a0676f50bee228"
+      "digest": "sha256:7e1ff82147559624c39b1e4e1837d6bde0f102ecd65ec01358987d92ff42f7ad"
     },
     "tph": {
       "digest": "sha256:bed3684a850651534f315d355cdeae50d951c429817df0f105cccdb7f4e1561b"
     },
     "ultragoal": {
-      "digest": "sha256:caa61789eb5ce01940cfaccf7e70e9290c1f318cb31e25d038eb45b26970c39c"
+      "digest": "sha256:31de0808e7e3458ebc3c59227353dfaf49ec8bd48429ae5e0b58b9e0597aa39f"
     },
     "verify": {
-      "digest": "sha256:03bd3b922a24d19ccc0b942d4f56d97f09e24939220a69d8fad8ba1144085d12"
+      "digest": "sha256:20ae2b56b4041cbb2e7e0cfe535bf2d1f7d26579371ce2b5e0cd1c31b09e23fd"
     }
   }
 }

package/skills/autopilot/SKILL.md

@@ -25,7 +25,7 @@ using `wp_ultragoal_run` / `wp ultragoal run` and the current handoff.
 
 ## Outside-voice (required)
 
-After each ultragoal **phase or plan-gate milestone**, run an **OpenCode Go** outside-voice review and pick the model by purpose. The purpose→family ordering lives in one place — the committed reviewer policy rendered into the `opencode-go` skill — so follow that skill and do not restate the ordering here. Resolve IDs from live `opencode models opencode-go`. `wp_review_gate` in the default authoritative mode is only for exact-version draft plan approval/auto-promotion; the same tool called with `mode: "advisory"` is for implementation/phase review and never mutates blueprint approval state on its own — a later authoritative call may promote a matching advisory approval without re-invoking a provider. Never self-approve. Full protocol: the `ultragoal` skill. Respect `review_budget` (default owned by `workflow-skills-routing.md`): one sequential path, no multi-host stampede.
+After each ultragoal **phase or plan-gate milestone**, run an **OpenCode Go** outside-voice review and pick the model by purpose. The purpose→family ordering lives in one place — the committed reviewer policy rendered into the `opencode-go` skill — so follow that skill and do not restate the ordering here. Resolve IDs from live `opencode models opencode-go`. `wp_review_gate` has one mode: purpose plan for exact-version draft plan approval/auto-promotion, purpose delivery for implementation/phase review; each new provider verdict is a formal round and an approval is authority immediately. Never self-approve. Full protocol: the `ultragoal` skill. Respect `review_budget` (default owned by `workflow-skills-routing.md`): one sequential path, no multi-host stampede.
 
 ## Vague gate
 

package/skills/claude/SKILL.md

@@ -16,7 +16,7 @@ until independently verified.
 - Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
 - If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
 
-## Advisory call
+## Gate call
 
 ```jsonc
 {
@@ -27,11 +27,14 @@ until independently verified.
   "authority_ref": "<full-head-sha>",
   "provider": "claude",
   "repository_access": "none",
-  "mode": "advisory",
 }
 ```
 
-Use authoritative mode only when formal plan or delivery approval is requested.
+Each newly executed provider review that reaches a verdict is one formal round of the
+slug's budget, and its approval is authority. An identical-subject call replays the recorded
+verdict with no new review and no new round. A partial approval, withheld because adjudication
+is incomplete (not every prior finding was briefed, or a briefed prior claim was marked
+still-open without a matching finding), grants no authority and spends no round.
 
 ## Model policy
 

package/skills/codex/SKILL.md

@@ -16,7 +16,7 @@ until independently verified.
 - Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
 - If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
 
-## Advisory call
+## Gate call
 
 ```jsonc
 {
@@ -27,11 +27,14 @@ until independently verified.
   "authority_ref": "<full-head-sha>",
   "provider": "codex",
   "repository_access": "none",
-  "mode": "advisory",
 }
 ```
 
-Use authoritative mode only when formal plan or delivery approval is requested.
+Each newly executed provider review that reaches a verdict is one formal round of the
+slug's budget, and its approval is authority. An identical-subject call replays the recorded
+verdict with no new review and no new round. A partial approval, withheld because adjudication
+is incomplete (not every prior finding was briefed, or a briefed prior claim was marked
+still-open without a matching finding), grants no authority and spends no round.
 
 ## Model policy
 

package/skills/fix/SKILL.md

@@ -61,7 +61,7 @@ the blast radius is broader than a local fix.
 - **Tooling / harness findings** ("fix inefficiency you come across", MCP vs shell,
   hook thrash) honor the same budget. Excess → record via the `tech-debt` skill
   (or backlog handoff); do not expand the current epic unbounded.
-- Prefer MCP `wp_*` and session-memory tools over `bin/wp` / raw shell for
+- Prefer MCP `wp_*` and session-memory tools over the `wp` CLI / raw shell for
   quality and discovery paths (see tooling map).
 
 ## Protocol
@@ -156,6 +156,24 @@ Escalate to `/verify <target>` (local) or `/verify <target> --merge-ready` when
 If the repaired behavior is already green but the diff still needs a bounded
 cleanup pass, use `ai-deslop` before the final verify handoff.
 
+### Tool recovery and delivery intent
+
+- Discover the managed owner's current identity with `wp_blueprint_projects`
+  using its absolute `cwd`; pass the returned project ID and matching checkout
+  to session tools. A blueprint ID is not a project ID.
+- If quality tooling refuses stale or cross-checkout execution, follow its
+  checkout-local recovery. Attach the escape to the actual command:
+  `cd <owner> && WP_MCP_UNAVAILABLE=1 wp test --files <test>`.
+  Attaching it to `cd` does not set it for `wp`.
+- For external tools whose schema requires exactly one of command or WebSocket
+  input, omit the unused option entirely; an empty object still supplies it.
+- When the request includes merge/landing, continue through verification,
+  exact-head delivery, PR merge, and managed-owner cleanup. A handoff or
+  continuation summary does not satisfy that request. If a required gate is
+  blocked, report its concrete evidence and remaining action; preserve the
+  persisted completion requirements. Run additional named stages only when
+  the user's request actually includes them.
+
 ### Step 6 — Report with evidence
 
 Keep it short:

package/skills/grok/SKILL.md

@@ -16,7 +16,7 @@ until independently verified.
 - Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
 - If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
 
-## Advisory call
+## Gate call
 
 ```jsonc
 {
@@ -27,11 +27,14 @@ until independently verified.
   "authority_ref": "<full-head-sha>",
   "provider": "grok",
   "repository_access": "none",
-  "mode": "advisory",
 }
 ```
 
-Use authoritative mode only when formal plan or delivery approval is requested.
+Each newly executed provider review that reaches a verdict is one formal round of the
+slug's budget, and its approval is authority. An identical-subject call replays the recorded
+verdict with no new review and no new round. A partial approval, withheld because adjudication
+is incomplete (not every prior finding was briefed, or a briefed prior claim was marked
+still-open without a matching finding), grants no authority and spends no round.
 
 ## Model policy
 

package/skills/opencode-go/SKILL.md

@@ -16,7 +16,7 @@ until independently verified.
 - Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
 - If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
 
-## Advisory call
+## Gate call
 
 ```jsonc
 {
@@ -26,20 +26,24 @@ until independently verified.
   "base_ref": "<full-base-sha>",
   "authority_ref": "<full-head-sha>",
   "provider": "opencode",
-  "model": "opencode-go/deepseek-v4-pro",
+  "model": "opencode-go/deepseek-v4.1-flash",
   "repository_access": "none",
-  "mode": "advisory",
 }
 ```
 
-Use authoritative mode only when formal plan or delivery approval is requested.
+Each newly executed provider review that reaches a verdict is one formal round of the
+slug's budget, and its approval is authority. An identical-subject call replays the recorded
+verdict with no new review and no new round. A partial approval, withheld because adjudication
+is incomplete (not every prior finding was briefed, or a briefed prior claim was marked
+still-open without a matching finding), grants no authority and spends no round.
 
 ## Model policy
 
-Default exact model: `opencode-go/deepseek-v4-pro`.
-Committed exact options: `opencode-go/deepseek-v4-pro`, `opencode-go/deepseek-v4-flash`, `opencode-go/kimi-k2.7-code`, `opencode-go/glm-5.3`, `opencode-go/minimax-m3`, `opencode-go/mimo-v2.5-pro`, `opencode-go/qwen3.8-max`, `opencode-go/mimo-v2.5`, `opencode-go/qwen3.7-plus`, `opencode-go/qwen3.7-max`, `opencode-go/qwen3.6-plus`, `opencode-go/gpt-5.6-luna`, `opencode-go/minimax-m2.7`, `opencode-go/kimi-k3`, `opencode-go/glm-5.2`, `opencode-go/kimi-k2.6`, `opencode-go/hy3`, `opencode-go/glm-5.1`, `opencode-go/grok-4.5`.
+Default exact model: `opencode-go/deepseek-v4.1-flash`.
+Committed exact options: `opencode-go/deepseek-v4.1-flash`, `opencode-go/glm-5.3-flash`, `opencode-go/deepseek-v4-pro`, `opencode-go/kimi-k2.7-code`, `opencode-go/qwen3.8-max`, `opencode-go/minimax-m3`, `opencode-go/muse-spark-1.3-contributor`, `opencode-go/mimo-v2.5-pro`, `opencode-go/muse-spark-1.2-contributor`, `opencode-go/union-alpha`, `opencode-go/qwen3.8-flash`, `opencode-go/mimo-v2.5`, `opencode-go/qwen3.7-plus`, `opencode-go/qwen3.7-max`, `opencode-go/qwen3.6-plus`, `opencode-go/minimax-m2.7`, `opencode-go/gpt-5.6-luna`, `opencode-go/longcat-2.0`, `opencode-go/kimi-k3`, `opencode-go/deepseek-v4-flash`, `opencode-go/deepseek-v4-flash-vision-exp`, `opencode-go/kimi-k2.6`, `opencode-go/hy4-preview`, `opencode-go/hy3`, `opencode-go/grok-4.6`, `opencode-go/glm-5.3`, `opencode-go/glm-5.2`, `opencode-go/glm-5.1`.
 Use a named exact option when requested; otherwise use the default. Provider catalog discovery
-belongs to the snapshot drift workflow, never to a skill invocation.
+belongs to the snapshot drift workflow, never to a skill invocation; reading the box-local
+credential store at gate time is a local file read, not catalog discovery.
 
 ## Review quality
 

package/skills/ralplan/SKILL.md

@@ -40,11 +40,25 @@ Use when the user invokes `$ralplan`, asks for RALPLAN, or wants consensus plann
 ## Iron laws
 
 1. **Blueprint is the plan.** Freeform notes are not durable consensus. Create or bind a blueprint before reviews.
-2. **Ground before drafting.** Code dive (+ bounded external research when needed) happens **before** the blueprint draft is treated as serious.
-3. **Reviews before refine.** Run risk-matched `plan-*` skills on the blueprint, apply findings, **then** `/plan-refine`.
-4. **No implementation.** Do not edit product source, commit implementation, or start `ultragoal`/`team`/`autopilot` unless the user explicitly switches out of planning.
-5. **No review stampede.** Do not fan out multi-host outside-voice swarms. Prefer in-host skill loads; at most one outside voice only if the user asks or the change is auth / data-loss / public-API sensitive.
-6. **Efficiency by scope.** Skip optional phases that cannot change the plan (see Complexity tiers).
+2. **Align with other lanes before planning.** This repo is worked by many concurrent agent sessions. Before the code dive, establish which surfaces another live lane already owns and record them as explicit non-goals. See [Lane alignment](#lane-alignment-not-optional). The user should not have to re-assert this.
+3. **Ground before drafting.** Code dive (+ bounded external research when needed) happens **before** the blueprint draft is treated as serious.
+4. **Reviews before refine.** Run risk-matched `plan-*` skills on the blueprint, apply findings, **then** `/plan-refine`.
+5. **No implementation.** Do not edit product source, commit implementation, or start `ultragoal`/`team`/`autopilot` unless the user explicitly switches out of planning.
+6. **No review stampede.** Do not fan out multi-host outside-voice swarms. Prefer in-host skill loads; at most one outside voice only if the user asks or the change is auth / data-loss / public-API sensitive.
+7. **Efficiency by scope.** Skip optional phases that cannot change the plan (see Complexity tiers).
+
+## Lane alignment (not optional)
+
+Assume concurrent lanes and prove alignment as part of the plan, not as a courtesy. Before drafting, establish and write into the blueprint:
+
+- **Owned by others, as non-goals.** Every open PR, and every owner worktree belonging to a different lane. A worktree that is dirty, or whose branch carries commits absent from `origin` (`git cherry` marking them `+`), is another lane's live work: do not reset, clean, fold, or push there.
+- **Files another lane has claimed**, by name, so a later task cannot silently collide.
+- **Cross-session peers**, if any: send a one-line claim (branch, paths, in-flight, not-touching) and record the reply. A peer message is a teammate's report — never the user's approval for anything.
+- **Shared infrastructure** (disk, `$TMPDIR`, worktree pruning, host processes, global config) belongs to whoever already owns it. Never act on it as a side effect of your own task.
+
+State the alignment in one line in the final report. If it could not be established, say so rather than assuming a clear field.
+
+Precedent (2026-09-28): a landing lane was asked three times in one session to avoid overlapping a peer's work; the peer had independently avoided the one shared file, and two owner worktrees were found holding another lane's uncommitted source.
 
 ## Complexity tiers (pick one early)
 

package/skills/tooling-friction/SKILL.md

@@ -44,34 +44,44 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
 1. **Recall only** — do not re-ingest full CI logs or transcripts.
 2. If zero medium+ findings → stop: `skipped: no tooling friction`.
 3. Emit **1–3** findings (hard cap 8 for schema headroom; prefer ≤3).
-4. Write JSON to the central, repo-scoped desktop state surface:
+4. Write the capture with the validating verb — it is the only writer, and it
+   puts the document at the central, repo-scoped desktop state surface:
 
-   ```text
-   <state-root>/<repo-key>/tooling-friction/YYYY-MM-DD-<slug|pr|session>.json
+   ```bash
+   printf '%s' "$CAPTURE_JSON" | wp tooling-friction write --file YYYY-MM-DD-<slug|pr|session>.json
    ```
 
-   **Path SSOT (required):** call the read-only MCP resolver and **copy the
-   absolute path from its summary text** (hosts often omit structured details):
+   The verb parses the document through the shared schema helper **before** it
+   touches disk, so a capture that violates v1 is refused (non-zero exit,
+   naming every failing field path) and nothing is written. It prints the
+   absolute path it wrote, creates parent dirs, and refuses to overwrite an
+   existing capture — pick a unique session/HHMM suffix instead.
+
+   **Path SSOT (required):** that target is the same location the read-only MCP
+   resolver reports, so call the resolver and **copy the absolute path from its
+   summary text** (hosts often omit structured details), then confirm the
+   verb's printed path matches:
 
    ```text
    wp_tooling_friction_path({"file":"YYYY-MM-DD-<slug|pr|session>.json"})
    → summary: tooling-friction path: <absolute-path>
    ```
 
-   Write only to that absolute path. Do **not** construct a path by hand.
+   Never write the capture to a hand-constructed path — not to a fleet folder
+   slug (`github.com-org-repo-*`), not to worktree-keyed desktop-state, not
+   under `Application Support` or `~/.webpresso`.
 
    - `repo-key` is a **16-hex** `repoIdentityV1(git-common-dir)` segment from
      `repoIdentityV1` under the pure preferred state root — **not** a fleet worktree folder slug such
      as `github.com-org-repo-<hash>` under `~/.webpresso/worktrees/repos/`.
    - Scope is always **repo** (shared by every worktree of that git common
      dir). Never use a worktree-keyed desktop-state surface for captures.
-   - Human CLI equivalent: `wp tooling-friction path --file <file>` (prints
-     the same absolute path on stdout).
+   - Human CLI surface: `wp tooling-friction path --file <file>` prints that
+     absolute path; `wp tooling-friction write --file <file>` writes it.
 
-   Create parent dirs as needed. If the returned path already exists, choose a
-   unique session/HHMM suffix rather than overwriting it. If the surface cannot
-   be resolved or written, report `tooling-friction: skipped: no state surface`
-   and stop; never fall back to a worktree or `.agent/` path.
+   If the surface cannot be resolved or written, report
+   `tooling-friction: skipped: no state surface` and stop; never fall back to a
+   worktree or `.agent/` path.
 
 5. Optional `--promote` or severity `high`/`critical`:  
    `wp tech-debt new "<short title>" --severity <s> --category tooling --status accepted`  

package/skills/ultragoal/SKILL.md

@@ -195,10 +195,10 @@ Fallback to `wp …` CLI only when the matching MCP tool is unavailable. Prefer
    the user sets N (the default value lives in `workflow-skills-routing.md`).
    Controller validation evidence is **machine-qa (prior QA phase) + N outside voices**
    (default N=1), not two outside model reviewers at budget 1.
-   Use `wp_review_gate` in the default authoritative mode only for exact-version
-   draft plan approval/auto-promotion. Use the same tool with `mode: "advisory"`
-   for implementation/phase outside voice; it never mutates blueprint approval
-   state on its own. A CLI delivery gate is explicit MCP-unavailable
+   `wp_review_gate` has one mode: purpose plan for exact-version draft plan
+   approval/auto-promotion, purpose delivery for implementation/phase outside
+   voice. Each new provider verdict is a formal round of the slug's budget and
+   an approval is authority immediately. A CLI delivery gate is explicit MCP-unavailable
    compatibility only, not this MCP contract. Use `wp_pr_*` for PR babysit — no
    multi-sleep poll loops; no parallel multi-reviewer stampede.
 8. Stop on `complete`, `cancelled`, blocked guard exhaustion, or `WP_ULTRAGOAL_DISABLE=1`.
@@ -217,16 +217,15 @@ primary checkout.
 
 ## Outside-voice review (required for autopilot)
 
-Autopilot and agent-driven ultragoal loops **must** request an **OpenCode Go** outside-voice review after each **goal/phase milestone**, and must pick the model by purpose. Use **`wp_review_gate`** in the default authoritative mode only for exact-version draft plan approval/auto-promotion. Use a single-shot **`wp_review_gate`** call with **`mode: "advisory"`** for implementation/phase outside voice; it never mutates blueprint approval state on its own — a later authoritative call may promote a matching advisory approval without re-invoking a provider. CLI delivery gates are explicit MCP-unavailable compatibility only, not this MCP contract.
+Autopilot and agent-driven ultragoal loops **must** request an **OpenCode Go** outside-voice review after each **goal/phase milestone**, and must pick the model by purpose. Use **`wp_review_gate`** purpose plan for exact-version draft plan approval/auto-promotion and one single-shot **`wp_review_gate`** purpose delivery call for implementation/phase outside voice. The gate has one mode: each newly executed provider review that reaches a verdict is a formal round of the slug's budget, an approval is authority immediately, and an identical-subject call replays the recorded verdict without a new round. CLI delivery gates are explicit MCP-unavailable compatibility only, not this MCP contract.
 
 Count each milestone review against `review_budget` for merge-ready claims: **exactly one sequential** reviewer path unless the user sets N; the default value is owned by `workflow-skills-routing.md`. Prefer purpose-matched OpenCode Go first; do not fan out multi-host review swarms.
 
 ### Milestones that require a review
 
-Run `wp_review_gate` (default authoritative mode) only for the plan approval
-milestone below. Run one single-shot `wp_review_gate` call with `mode:
-"advisory"` for implementation/phase milestones; it is advisory and does not
-promote or otherwise mutate blueprint approval state on its own.
+Run `wp_review_gate` purpose plan for the plan approval milestone below and one
+single-shot `wp_review_gate` purpose delivery call for implementation/phase
+milestones. Each new provider verdict is one formal round of the slug's budget.
 
 | Milestone          | When                                                                                                                             |
 | ------------------ | -------------------------------------------------------------------------------------------------------------------------------- |

package/skills/verify/SKILL.md

@@ -41,18 +41,18 @@ the preferred skill (`claude` / `codex` / `grok` / one OpenCode Go), then stops.
 
 ## Tooling map
 
-| Gate                      | Prefer                                                                                                  |
-| ------------------------- | ------------------------------------------------------------------------------------------------------- |
-| Lint / types / tests / QA | `wp_lint`, `wp_typecheck`, `wp_test`, `wp_qa`                                                           |
-| Format                    | `wp_format`                                                                                             |
-| Audits                    | `wp_audit`, `wp_audits`                                                                                 |
-| Blueprint                 | blueprint MCP tools + `wp_audit`                                                                        |
-| PR / CI wait              | `wp_pr_status`, `wp_pr_wait` (not multi-sleep loops)                                                    |
-| Release                   | `wp_release_progress` for live Release phases; `wp_release_readiness` for package gates                 |
-| Large output              | `wp_session_execute` / `batch_execute` / `execute_file`                                                 |
-| Continuity                | `wp_session_capture` for verify summary; avoid paste-back walls                                         |
-| E2E / act                 | `wp_e2e`, `wp_ci_act` when the change requires them                                                     |
-| Outside authority         | `wp_review_gate` (authoritative) for plans; `wp_review_gate` with `mode: "advisory"` for implementation |
+| Gate                      | Prefer                                                                                   |
+| ------------------------- | ---------------------------------------------------------------------------------------- |
+| Lint / types / tests / QA | `wp_lint`, `wp_typecheck`, `wp_test`, `wp_qa`                                            |
+| Format                    | `wp_format`                                                                              |
+| Audits                    | `wp_audit`, `wp_audits`                                                                  |
+| Blueprint                 | blueprint MCP tools + `wp_audit`                                                         |
+| PR / CI wait              | `wp_pr_status`, `wp_pr_wait` (not multi-sleep loops)                                     |
+| Release                   | `wp_release_progress` for live Release phases; `wp_release_readiness` for package gates  |
+| Large output              | `wp_session_execute` / `batch_execute` / `execute_file`                                  |
+| Continuity                | `wp_session_capture` for verify summary; avoid paste-back walls                          |
+| E2E / act                 | `wp_e2e`, `wp_ci_act` when the change requires them                                      |
+| Outside authority         | `wp_review_gate` (purpose plan or delivery); each new provider verdict is a formal round |
 
 ## Iron law — evidence before claims
 
@@ -245,7 +245,7 @@ in outside-voice usage — stop and fix the gate, do not multiply reviewers.
 **Skip this entire phase** for default `/verify` and `/verify --full`. Local
 `done` claims do not require outside voice.
 
-This phase implements **land-policy M7** (delivery vs advisory). Full land
+This phase implements **land-policy M7** (delivery vs outside voice). Full land
 language and dual-label contract:
 [`catalog/agent/rules/land-policy.md`](../../rules/land-policy.md).
 
@@ -269,34 +269,37 @@ When classification is **sensitive**:
 
 - Require delivery review via `risk-review-coverage` / `wp_review_gate`
   (purpose delivery) / qualifying lane approvals for the current
-  review subject until `policySatisfied` (**approval** or valid same-subject
-  **maintainer-override**). A formal **reject** is a terminal automated-review
+  review subject until `policySatisfied` (**approval**). A formal **reject** is a terminal automated-review
   outcome but does **not** satisfy land policy: Product status stays
-  `incomplete`, Process status stays `sensitive-blocked` until approval or
-  override. Tech-debt is **not** a substitute for delivery approval.
+  `incomplete`, Process status stays `sensitive-blocked` until approval.
+  Tech-debt is **not** a substitute for delivery approval.
 - Launch **exactly one at a time** `wp_review_gate` delivery attempt with
   `--base-ref <base-sha>` and `--authority-ref <head-sha>`. Do not substitute
   `HEAD` for the authority SHA, and do not relaunch while the same subject has
   an in-progress gate.
-- On formal **reject**: surface the gate `next_action` (`report_delivery_reject`)
-  / reject projection to the user; free-triage against blueprint non-goals;
-  address the findings, then re-review only a changed exact subject. The shared
-  gate permits five distinct rejected delivery subjects by default. Once that
-  budget is exhausted, **do not** set `scope_continue=true` without explicit
-  user authorization; agents must not invent the grant. For plan or delivery,
-  only an operator may request an absolute finite same-slug ceiling through MCP
-  `scope_continue_limit` (10..32); the field still requires
-  `scope_continue=true`. MCP wins over `WP_REVIEW_SCOPE_CONTINUE_LIMIT`; when
-  neither is present, the plan/delivery defaults are 16/10. Machine enforcement
-  does not link successor slugs; creating one to launder or bypass the budget
-  remains procedurally forbidden, as do resets and retry schemes.
+- On formal **reject**: record the gate `next_action` (`report_delivery_reject`)
+  / reject projection, triage against blueprint non-goals, address the findings,
+  then re-review only a changed exact subject. The gate counts formal verdicts
+  per slug and purpose, starting with five rounds.
+  After all allowance is spent, a corrected subject may open one
+  extra lane on an explicitly selected provider and model, including one that
+  already reviewed the lineage. The gate records that grant, adds five formal
+  rounds, and permits at most five distinct provider attempts in the new lane
+  that reach a verdict or an unproven outcome; provider infrastructure failures
+  spend no attempt but are bounded separately at five per lane. The provider and model remain pinned.
+  Once that lane is spent, this blueprint's review lineage is terminal: no
+  gate call on its slug can reopen it, whatever the subject. Re-plan the
+  narrowed scope as a new blueprint with its own plan review.
+  Machine enforcement does not link successor slugs; creating one to launder
+  or bypass the budget remains procedurally forbidden, as do resets and retry
+  schemes.
 - `Review-skip` is **FORBIDDEN** (`sensitive-review-skip-forbidden`).
 - Completed owner blueprint must be present in the PR
   (`sensitive-no-completed-owner` otherwise).
 - Process label when blocked: `sensitive-blocked`. When delivery lane
   approves: `delivery-approved`.
 
-### 3. Standard → skip or one advisory outside voice
+### 3. Standard → skip or one outside voice
 
 When classification is **standard**:
 
@@ -308,8 +311,8 @@ When classification is **standard**:
 
   Must be start-of-line. Process label: `standard-skip`.
 
-- Otherwise obtain **exactly one sequential** advisory outside voice
-  (`wp_review_gate` with `mode: "advisory"`, or host skill). Process label: `outside-approved`.
+- Otherwise obtain **exactly one sequential** outside voice: one
+  `wp_review_gate` delivery gate (or host skill). Process label: `outside-approved`.
 - At most **one OpenCode Go reviewer** counts unless the user asks for more.
 - Invoke the selected reviewer **once**. Do not probe, retry, or rotate
   providers automatically, and **never** fan out parallel multi-host review
@@ -345,26 +348,20 @@ Never invent a land-now skip. See `land-policy` for the full table.
   observed; wait timeout/abort/in-progress/not-found are not reviewer verdicts.
   `not_found` means there is no active or terminal gate for that subject; refresh
   state and start the gate again instead of continuing to wait.
-- Implementation / delivery approval: for sensitive PRs use `wp_review_gate`
-  purpose delivery, default authoritative mode, on the immutable subject; for
-  standard advisory use the same `wp_review_gate` call with `mode: "advisory"`
-  exactly once with the selected provider. Do not run a separate provider
-  probe. A later authoritative call on the same subject may promote a
-  matching complete advisory approval to authority with zero provider
-  invocation, unless a completed reject already exists for that content at
-  either stage.
-- `advisory-exhausted` is a terminal outcome with no ledger event and no
-  verdict — treat it as terminal-without-authority. It means this exact
-  digest already used its advisory attempt budget; do not retry the same
-  content or report it as a failure. Change the reviewed content (which mints
-  a new digest) or spend real authoritative budget instead. It is always
-  returned synchronously; no `wp_review_gate_wait` poll is ever needed or
-  issued for it.
-- An advisory gate and an authoritative gate on the same subject cannot run
-  concurrently — unlike the removed `wp_review_run`, an advisory
-  `wp_review_gate` call claims the same active marker an authoritative call
-  does. If a call reports marker contention, serialize the two calls rather
-  than treating contention as an error.
+- Implementation / delivery approval: use `wp_review_gate` purpose delivery
+  on the immutable subject, exactly once with the selected provider, for
+  sensitive and standard PRs alike. The gate has one mode: each newly executed
+  provider review that reaches a verdict is one formal round of the slug's
+  budget, an approval is authority immediately, and an identical-subject call
+  replays the recorded verdict without a new round (an approval withheld for
+  incomplete adjudication of prior findings — not all briefed, or a briefed
+  claim still open without a matching finding — grants no authority and
+  spends none). Do not run a separate
+  provider probe.
+- Two gates on the same subject cannot run concurrently — every
+  `wp_review_gate` call claims the subject's active marker. If a call reports
+  marker contention, serialize the two calls rather than treating contention
+  as an error.
 - Each gate reviewer must return exactly one schema-valid JSON review object;
   never infer a verdict from Markdown. The gate derives approval from typed
   findings: blockers reject, nits approve with nits, and no findings approve.