@webpresso/plugin-opencode 0.0.15 → 0.0.17

package/bin/wp

@@ -17,8 +17,11 @@
 #      when the admitted repository's own .git/worktrees/*/gitdir names it.
 #   3. else (no checkout ancestor at all) the nearest ancestor
 #      .webpressorc.json: its top-level exact-semver "runtime" pin
-#      -> ~/.webpresso/runtimes/<pin>/wp (missing = error)
-#   4. else the newest stable ~/.webpresso/runtimes/<x.y.z>/wp
+#      -> ~/.webpresso/versions/<pin>/bin/wp, else the legacy
+#      ~/.webpresso/runtimes/<pin>/wp (missing = error)
+#   4. else the installer's active release ~/.webpresso/current/bin/wp, else
+#      the newest stable ~/.webpresso/versions/<x.y.z>/bin/wp, else the legacy
+#      newest stable ~/.webpresso/runtimes/<x.y.z>/wp
 #   5. else a named error, exit 127 — never a different runtime. A pre-shim
 #      ~/.webpresso/bin/wp is never run implicitly (nothing in it proves it is
 #      a release rather than a development build); name it with
@@ -110,7 +113,12 @@ is_exact_semver() {
   return 0
 }
 
-runtimes_dir=${HOME:-}/.webpresso/runtimes
+# Release layout literals; src/runtime/runtime-selector-vocab.ts (WP_RELEASE_LAYOUTS)
+# is the authority and bin/wp-shim.subprocess.test.ts asserts both directions.
+webpresso_home=${HOME:-}/.webpresso
+current_release=$webpresso_home/current/bin/wp
+versions_dir=$webpresso_home/versions
+runtimes_dir=$webpresso_home/runtimes
 
 # Sets PIN to the top-level "runtime" of $1 (empty when absent). The document
 # is opened non-blocking, must be a regular file, and is read through a
@@ -146,33 +154,50 @@ read_pin() {
   return 1
 }
 
-choose_latest_release() {
-  best=
+# Sets BEST to the newest stable x.y.z under directory $1 whose release binary
+# is "$1/<version>/$2" (an executable file); empty when there is none.
+scan_releases() {
+  BEST=
   best_major=
   best_minor=
   best_patch=
-  for entry in "$runtimes_dir"/*/; do
+  for entry in "$1"/*/; do
     [ -d "$entry" ] || continue
     entry=${entry%/}
     version=${entry##*/}
     is_exact_semver "$version" stable || continue
-    [ -f "$entry/wp" ] && [ -x "$entry/wp" ] || continue
+    [ -f "$entry/$2" ] && [ -x "$entry/$2" ] || continue
     major=${version%%.*}
     rest=${version#*.}
     minor=${rest%%.*}
     patch=${rest#*.}
-    if [ -z "$best" ] ||
+    if [ -z "$BEST" ] ||
       [ "$major" -gt "$best_major" ] ||
       { [ "$major" -eq "$best_major" ] && [ "$minor" -gt "$best_minor" ]; } ||
       { [ "$major" -eq "$best_major" ] && [ "$minor" -eq "$best_minor" ] && [ "$patch" -gt "$best_patch" ]; }; then
-      best=$version
+      BEST=$version
       best_major=$major
       best_minor=$minor
       best_patch=$patch
     fi
   done
-  if [ -n "$best" ]; then
-    choose latest-release "$runtimes_dir/$best/wp"
+}
+
+# The installer's active release (the current link) wins, then the newest
+# versions/x.y.z/bin/wp, then the legacy runtimes/x.y.z/wp.
+choose_latest_release() {
+  if [ -f "$current_release" ] && [ -x "$current_release" ]; then
+    choose current-release "$current_release"
+    return 0
+  fi
+  scan_releases "$versions_dir" bin/wp
+  if [ -n "$BEST" ]; then
+    choose latest-release "$versions_dir/$BEST/bin/wp"
+    return 0
+  fi
+  scan_releases "$runtimes_dir" wp
+  if [ -n "$BEST" ]; then
+    choose latest-release "$runtimes_dir/$BEST/wp"
     return 0
   fi
   return 1
@@ -189,14 +214,15 @@ choose_release() {
     read_pin "$rc_file" || fail pin-invalid "$rc_file $PIN_PROBLEM."
     if [ -n "$PIN" ]; then
       is_exact_semver "$PIN" || fail pin-invalid "$rc_file pins runtime \"$PIN\"; use an exact version such as 1.2.3 (no ranges)."
-      pinned=$runtimes_dir/$PIN/wp
-      [ -f "$pinned" ] && [ -x "$pinned" ] || fail pin-not-installed "$rc_file pins runtime $PIN, but $pinned is not installed under $runtimes_dir."
+      pinned=$versions_dir/$PIN/bin/wp
+      [ -f "$pinned" ] && [ -x "$pinned" ] || pinned=$runtimes_dir/$PIN/wp
+      [ -f "$pinned" ] && [ -x "$pinned" ] || fail pin-not-installed "$rc_file pins runtime $PIN, but it is installed under neither $versions_dir/$PIN/bin/wp nor $runtimes_dir/$PIN/wp."
       choose pinned-release "$pinned"
       return 0
     fi
   fi
   choose_latest_release && return 0
-  fail no-release-installed "no webpresso source checkout above $PWD and no release under $runtimes_dir; install the Webpresso app, or name a runtime explicitly with WEBPRESSO_WP_BIN (for example a pre-shim \$HOME/.webpresso/bin/wp release) or WP_FORCE_JIT_PATH (a source checkout)."
+  fail no-release-installed "no webpresso source checkout above $PWD and no release at $current_release, under $versions_dir or under $runtimes_dir; install the Webpresso app, or name a runtime explicitly with WEBPRESSO_WP_BIN (for example a pre-shim \$HOME/.webpresso/bin/wp release) or WP_FORCE_JIT_PATH (a source checkout)."
 }
 
 : "${WEBPRESSO_WP_BIN:=}"

package/index.js

@@ -848,6 +848,47 @@ function sessionIdFrom(source) {
   const candidate = record.sessionID ?? record.sessionId ?? record.session_id;
   return typeof candidate === "string" && candidate.length > 0 ? candidate : null;
 }
+var DELEGATION_POLICY = {
+  tool: "subagent",
+  option: "delegationAllowedAllocations",
+  maxEntries: 128,
+  maxLength: 256,
+  allocationPattern: /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+#[A-Za-z0-9._-]+$/u,
+};
+function enforceDelegationAllocation(options, input) {
+  const allowed = options?.[DELEGATION_POLICY.option];
+  if (
+    !Array.isArray(allowed) ||
+    allowed.length === 0 ||
+    allowed.length > DELEGATION_POLICY.maxEntries ||
+    !allowed.every(
+      (entry) =>
+        typeof entry === "string" &&
+        entry.length <= DELEGATION_POLICY.maxLength &&
+        DELEGATION_POLICY.allocationPattern.test(entry),
+    )
+  ) {
+    throw new Error(
+      "WP_DELEGATION_POLICY_INVALID: configure delegationAllowedAllocations with explicit provider/model#variant entries from the live model catalog.",
+    );
+  }
+  const model =
+    typeof input === "object" && input !== null && !Array.isArray(input) ? input.model : undefined;
+  if (
+    typeof model !== "string" ||
+    model.length > DELEGATION_POLICY.maxLength ||
+    !DELEGATION_POLICY.allocationPattern.test(model)
+  ) {
+    throw new Error(
+      "WP_DELEGATION_ALLOCATION_REQUIRED: supply an explicit provider/model#variant for every subagent call, including continuations.",
+    );
+  }
+  if (!allowed.includes(model)) {
+    throw new Error(
+      "WP_DELEGATION_ALLOCATION_DENIED: the requested model and variant are not in delegationAllowedAllocations.",
+    );
+  }
+}
 var pinnedContextMatches = (ctx) => ctx;
 function applyModelCeilings(editor) {
   for (const { providerID, id, limit } of editor.list()) {
@@ -1162,6 +1203,10 @@ function createWebpressoOpenCodePlugin(deps = {}) {
         registrations.push(
           await host.tool.hook(OPENCODE_V2_DOMAIN_HOOKS.toolBefore, async (event) => {
             event.tool = canonicalToolName(event.tool);
+            if (event.tool === DELEGATION_POLICY.tool) {
+              enforceDelegationAllocation(host.options, event.input);
+              return;
+            }
             const sessionID = sessionIdFrom(event);
             const sessionDirectory = await resolveSessionDirectory(sessionID);
             const payload = hookInputForTool(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpresso/plugin-opencode",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "private": false,
   "description": "OpenCode V2 plugin adapter package for the Webpresso app (wp CLI; pinned 2.0.32 setup/domain-hook contract).",
   "homepage": "https://github.com/webpresso/app#readme",

package/plugin-skill-ownership.json

@@ -2,14 +2,17 @@
   "schemaVersion": 1,
   "host": "opencode",
   "packageName": "@webpresso/plugin-opencode",
-  "packageVersion": "0.0.15",
+  "packageVersion": "0.0.17",
   "runtimeDirs": [],
   "skills": {
     "ai-deslop": {
       "digest": "sha256:cf07df5835037f10401400e220c1c923f5325a6149d59c231ce316e10595fdfc"
     },
+    "antigravity": {
+      "digest": "sha256:729c4dd74e5c6394c31de23d04f664140088ee58ddfc57f3a2751394945a938b"
+    },
     "autopilot": {
-      "digest": "sha256:6a72b2db563a48742c501f20d509050f193a5d31f2d413f6bef838f277d470c1"
+      "digest": "sha256:8355f6ddc6e53e68ada49248bdd8d8beb0069ed09d3f2d346debc2401270445c"
     },
     "autoresearch": {
       "digest": "sha256:b4d51cd53beb4a3271827172dfbd0b1d27bd58761ca07a35d49a5d6324b87fdf"
@@ -21,19 +24,19 @@
       "digest": "sha256:21fd24862e7f7c8a1feadea6bc376492b136b99fc381cf1b8927c9db80615431"
     },
     "claude": {
-      "digest": "sha256:0205d693121b740b76041f1e25925a70d665774f7493070cdd6df40d0058ffe6"
+      "digest": "sha256:63b7afb2b65f65fb142e5ef142f80516be00c54d449c5fa7d7897bcaa6cae657"
     },
     "codex": {
-      "digest": "sha256:88837502404449b641b71dbc4f018c75dab6294ad98af29d41de50e98649ff0e"
+      "digest": "sha256:574669e040141e9986e362e9f46e3176aa47eccfda0f4589205d9d6d65e57b8d"
     },
     "deep-interview": {
-      "digest": "sha256:79fbf86a86024a311583a1500bb6960c82ad1383cc9f8ed3f04bbace41848ff7"
+      "digest": "sha256:6feeaa35de63a0e1f39dbe2882ca91a72928a058f138d4d79e70d81d09209693"
     },
     "deep-research": {
       "digest": "sha256:ece766cb18869317d7c8992fc562920b03250ff8c44bdcb9eccdc3b21922a83f"
     },
     "delivery-program": {
-      "digest": "sha256:ebd6b35036c12fa26ff98649ac57ede607b7b3526c401784670a5ce68369a691"
+      "digest": "sha256:a2222cc04fb5366026b951273e4e5d5d8c296d426d51706da8a6b56761a4567f"
     },
     "design-review": {
       "digest": "sha256:5b213735e2842568774572f36b198bccf03c03a54b2732484aadd023f04acb23"
@@ -42,22 +45,22 @@
       "digest": "sha256:306355888da0827e3523022077f731845726bbaaf595ca12515cc91d8605b5e6"
     },
     "fix": {
-      "digest": "sha256:4804c546291316439aad3ea05fb7d3f043bc191abd8b9c180eb1d349f19f64cf"
+      "digest": "sha256:aa5caa229f0a56290bd6ad4487f41fd2933ac9e9cf4fdf2191f04a559bf66943"
     },
     "handoff": {
-      "digest": "sha256:eda4410dc75019b40b1ffae5f301bfc1e57d9313241d170e4743d379a1b6d846"
+      "digest": "sha256:5d40899f54fabe3f6ec8f99b417345a433850585086570872a137a1d0d837002"
     },
     "hooks-doctor": {
-      "digest": "sha256:9d9147e842246955f284854c35cf57237d4d056dca23f4c66019e1b44bb09eb6"
+      "digest": "sha256:6169e2b4b3638b9b5430811cd44e7952a54685b6f6556ebe81a9aee8ade1a3e0"
     },
     "investigate": {
-      "digest": "sha256:778b3a1f38323e8dd6101c6ace26ff8aada1246b20952b3641d5d1049bc50055"
+      "digest": "sha256:b6d82b2dc76297167a8fb75422d1f7037c4b9f0c74186cc4a2d719246764ca7e"
     },
     "lore-protocol": {
       "digest": "sha256:a80fbacc765e8b886437b9fdf7dd71e1ceb1b98b939078ec90fc88d06a8b4c69"
     },
     "opencode-go": {
-      "digest": "sha256:a304b282fa078f97c2aa6a7d040d30eaae4c735de0aa5edf3af7368f62491804"
+      "digest": "sha256:9498e4f9d9c1b8ee2355d9ca57c65eaf2a3a9dbc2ba11ef0c4b0428769949f05"
     },
     "plan-ceo-review": {
       "digest": "sha256:4d426158518dd71f8998770e8d4037bcbfa3c65d7265a93a4a78a9b015ba881e"
@@ -72,31 +75,31 @@
       "digest": "sha256:b728dad90254d4c9f81b3818321d34ab53519b79ce20ff3bfe08bfacb2aa3e86"
     },
     "plan-refine": {
-      "digest": "sha256:cf2c0743a81b0d8954417482e7812212a6a90e5046926c44cd82a6a309dfdc26"
+      "digest": "sha256:8a0e38564627565d267b347a0361eb222b9ba230961998c2d6812874ea7cf608"
     },
     "ralplan": {
-      "digest": "sha256:d3e8ab6285f9882d18ee9feabf51bb6dd9d81f8aaa243c050e9eeaa3436927af"
+      "digest": "sha256:95d02771d3e3a46d225b1bf9dd12a33e83c9e0dbe2c126aad24986c4cb1d98a3"
     },
     "team": {
-      "digest": "sha256:c27107b46e0cd7b9c264a6f51f74f505920d63e7ee2a2d26d2f288592fd10bd2"
+      "digest": "sha256:e403a5a92d145e777d7a344fe8fc6fe5df44640691aa2319b6dfd50b909166f5"
     },
     "tech-debt": {
-      "digest": "sha256:2018bf8dc5f338baee3d982a5bf28c48773befea08e44f33b70561c18d897c56"
+      "digest": "sha256:fd2f8e26e006c9c5ed5ef6f1678c3f7472a35dfd2f743e58f7ec348606399353"
     },
     "testing-philosophy": {
       "digest": "sha256:23fdad944b089de3cfcd13957a5ac10c37bd3d136b192029af69368bca1470db"
     },
     "tooling-friction": {
-      "digest": "sha256:64992c6a789d0283b7379a914d7686af5db97fe48cb5929f800a11d8f8e8f126"
+      "digest": "sha256:6f94949b6910d88ff974a95f4cd67bbaca05579db88fbeacc50126a13faf800b"
     },
     "tph": {
       "digest": "sha256:bed3684a850651534f315d355cdeae50d951c429817df0f105cccdb7f4e1561b"
     },
     "ultragoal": {
-      "digest": "sha256:344177e32690fe6355577abe50659cea1af682933a78eb13a11765d1a1ad66d7"
+      "digest": "sha256:e60091f795311fd4ee8779b60b04f835522163fcca5d27122740b66f66afeceb"
     },
     "verify": {
-      "digest": "sha256:c77aeb48d1d605496ed3b573b598323aff439e2bc9950a4369da8b3b43886b6a"
+      "digest": "sha256:e1aa3baed96ef005b144e17fac8a2153b90a075b142acee2fdfba7c89e613765"
     }
   }
 }

package/skills/antigravity/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: antigravity
+description: "Antigravity outside-voice reviewer through Webpresso MCP."
+license: MIT
+---
+
+# Antigravity outside-voice review
+
+Use only for a requested content-bound plan or delivery review. Treat output as external advice
+until independently verified.
+
+## MCP-only contract
+
+- Call `review_gate` exactly once for the real plan version or delivery diff.
+- Observe the same durable operation with `review_gate_wait` when needed.
+- Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
+- If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
+
+## Gate call
+
+```jsonc
+{
+  "project_id": "<project>",
+  "slug": "<blueprint-slug>",
+  "purpose": "delivery",
+  "base_ref": "<full-base-sha>",
+  "authority_ref": "<full-head-sha>",
+  "caller_model": "<your own model id, exactly as your host reports it>",
+  "repository_access": "none",
+}
+```
+
+Each newly executed provider review that reaches a verdict is one formal round of the
+slug's budget, and its approval is authority. An identical-subject call replays the recorded
+verdict with no new review and no new round. A partial approval, withheld because adjudication
+is incomplete (not every prior finding was briefed, or a briefed prior claim was marked
+still-open without a matching finding), grants no authority and spends no round.
+
+## Reviewer selection
+
+Pass `caller_model` with your OWN model id, exactly as your host reports it, and omit
+`provider`, `model`, and `effort`: the gate selects the reviewer route itself — a cross-family
+reviewer chosen for capability, current provider limits, and measured daily cost — and reports
+the choice in `policy_selection`. Never name a reviewer model, probe a provider CLI for its
+catalog, or read a credential store to discover models at invocation time; provider catalog
+discovery belongs to the snapshot drift workflow. An operator may still pass an explicit
+`provider`/`model` as a human override; agents must not.
+
+## Review quality
+
+Follow `catalog/agent/rules/review-methodology-sota.md`; report typed verdict, model,
+artifact, grounded findings, and independently verified conclusions.

package/skills/autopilot/SKILL.md

@@ -21,11 +21,11 @@ argument-hint: "<brief|force: brief>"
 - parallel ready-set execution under ultragoal controller
 
 Drive an approved brief through `plan -> execute -> qa -> validate -> land -> complete`
-using `wp_ultragoal_run` / `wp ultragoal run` and the current handoff.
+using `ultragoal_run` / `wp ultragoal run` and the current handoff.
 
 ## Outside-voice (required)
 
-After each ultragoal **phase or plan-gate milestone**, run an **OpenCode Go** outside-voice review and pick the model by purpose. The purpose→family ordering lives in one place — the committed reviewer policy rendered into the `opencode-go` skill — so follow that skill and do not restate the ordering here. Resolve IDs from live `opencode models opencode-go`. `wp_review_gate` has one mode: purpose plan for exact-version draft plan approval/auto-promotion, purpose delivery for implementation/phase review; each new provider verdict is a formal round and an approval is authority immediately. Never self-approve. Full protocol: the `ultragoal` skill. Respect `review_budget` (default owned by `workflow-skills-routing.md`): one sequential path, no multi-host stampede.
+After each ultragoal **phase or plan-gate milestone**, run an outside-voice review. Pass `caller_model` with your own model id and omit `provider`/`model`/`effort`: the gate selects the cross-family reviewer route itself (capability, limits, measured daily cost) and reports it in `policy_selection`. Never resolve model ids from a live catalog at invocation time. `review_gate` has one mode: purpose plan for exact-version draft plan approval/auto-promotion, purpose delivery for implementation/phase review; each new provider verdict is a formal round and an approval is authority immediately. Never self-approve. Full protocol: the `ultragoal` skill. Respect `review_budget` (default owned by `workflow-skills-routing.md`): one sequential path, no multi-host stampede.
 
 ## Vague gate
 
@@ -45,23 +45,23 @@ skill.
 
 ## Tooling map
 
-| Pipeline step        | Tools                                                                                                                                               |
-| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Plan                 | `plan-refine`, `wp_blueprint_*`, `wp_session_capture` for decisions                                                                                 |
-| Create controller    | `wp_ultragoal_new`, `wp_worktree`                                                                                                                   |
-| Execute              | ready-set via blueprint tools; `/goal` or parallel subagents; `wp_session_context` for delegates; `wp_blueprint_task_verify` only to complete tasks |
-| Opportunistic repair | `/fix` up to `fix_budget`; else handoff backlog                                                                                                     |
-| QA                   | `wp_qa` / `wp_lint` / `wp_typecheck` / `wp_test`; PR checks via `wp_pr_status` / `wp_pr_wait`                                                       |
-| Validate             | one outside voice if merge-bound (OpenCode Go by purpose, or claude/codex); `wp review gate` for authority                                          |
-| Land                 | `wp_pr_upsert`, green required checks, merge + owner cleanup                                                                                        |
-| Blocked / stop       | `wp_ultragoal_handoff` ≤40 lines; `wp_ultragoal_cancel` if abandoned                                                                                |
+| Pipeline step        | Tools                                                                                                                                                                                                                                                                                             |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Plan                 | `plan-refine`, `blueprint_*`, `session_capture` for decisions                                                                                                                                                                                                                                     |
+| Create controller    | `ultragoal_new`, `worktree`                                                                                                                                                                                                                                                                       |
+| Execute              | ready-set via blueprint tools; `/goal` or parallel subagents; `session_context` for delegates; `blueprint_task_verify` only to complete tasks                                                                                                                                                     |
+| Opportunistic repair | `/fix` up to `fix_budget`; else handoff backlog                                                                                                                                                                                                                                                   |
+| QA                   | `qa` / `lint` / `typecheck` / `test`; PR checks via `pr_status` / `pr_wait`                                                                                                                                                                                                                       |
+| Validate             | one outside voice if merge-bound (the gate picks the cross-family reviewer from `caller_model`); `wp review gate` for authority                                                                                                                                                                   |
+| Land                 | `pr_upsert`, green required checks, merge + owner cleanup                                                                                                                                                                                                                                         |
+| Blocked / stop       | `ultragoal_handoff` ≤40 lines; if the send channel is capped, the handoff records send-budget state (attempt count, last canary result); judgment requests ride the typed envelope or are named in the manifest; preserve the outbox, never route around a pause; `ultragoal_cancel` if abandoned |
 
 ## Pipeline
 
 1. **Plan:** refine blueprints and satisfy provenance-backed promotion approvals.
 2. **Execute:** implement current **ready** tasks in parallel up to `concurrency`; use only
-   `wp_blueprint_task_verify` to mark them done.
-3. **QA:** run affected checks and `wp_qa`; preserve normalized failure evidence. Prefer
+   `blueprint_task_verify` to mark them done.
+3. **QA:** run affected checks and `qa`; preserve normalized failure evidence. Prefer
    PR-bound CI when a PR exists.
 4. **Validate:** obtain verification + code-review evidence within `review_budget`. Each
    lane appends a tracked `reviews.md` record in one of these exact forms:
@@ -73,10 +73,10 @@ skill.
 
 5. **Land:** require green PR checks, complete the blueprint in the same PR, merge, and
    run owner cleanup.
-6. **Complete:** stop only when `wp_ultragoal_run` records terminal evidence.
+6. **Complete:** stop only when `ultragoal_run` records terminal evidence.
 
 Resume from durable state after interruption. Obey `WP_ULTRAGOAL_DISABLE=1`,
 iteration/error/validation caps, and repository ownership. Never self-approve, directly
 mark tasks done, bypass evidence, push to main, or increase timeouts (keep every loop bounded and never increase timeouts). After every phase
-transition recorded by `wp ultragoal run`, obtain a fresh OpenCode Go outside review
+transition recorded by `wp ultragoal run`, obtain a fresh outside-voice review
 before treating the milestone as closed (see Outside-voice above and the `ultragoal` skill).

package/skills/claude/SKILL.md

@@ -11,8 +11,8 @@ until independently verified.
 
 ## MCP-only contract
 
-- Call `wp_review_gate` exactly once for the real plan version or delivery diff.
-- Observe the same durable operation with `wp_review_gate_wait` when needed.
+- Call `review_gate` exactly once for the real plan version or delivery diff.
+- Observe the same durable operation with `review_gate_wait` when needed.
 - Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
 - If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
 
@@ -25,7 +25,7 @@ until independently verified.
   "purpose": "delivery",
   "base_ref": "<full-base-sha>",
   "authority_ref": "<full-head-sha>",
-  "provider": "claude",
+  "caller_model": "<your own model id, exactly as your host reports it>",
   "repository_access": "none",
 }
 ```
@@ -36,10 +36,15 @@ verdict with no new review and no new round. A partial approval, withheld becaus
 is incomplete (not every prior finding was briefed, or a briefed prior claim was marked
 still-open without a matching finding), grants no authority and spends no round.
 
-## Model policy
+## Reviewer selection
 
-When the user names an exact model, pass it in the MCP `model` field. Otherwise omit
-that field and let the MCP owner select the configured provider default.
+Pass `caller_model` with your OWN model id, exactly as your host reports it, and omit
+`provider`, `model`, and `effort`: the gate selects the reviewer route itself — a cross-family
+reviewer chosen for capability, current provider limits, and measured daily cost — and reports
+the choice in `policy_selection`. Never name a reviewer model, probe a provider CLI for its
+catalog, or read a credential store to discover models at invocation time; provider catalog
+discovery belongs to the snapshot drift workflow. An operator may still pass an explicit
+`provider`/`model` as a human override; agents must not.
 
 ## Review quality
 

package/skills/codex/SKILL.md

@@ -11,8 +11,8 @@ until independently verified.
 
 ## MCP-only contract
 
-- Call `wp_review_gate` exactly once for the real plan version or delivery diff.
-- Observe the same durable operation with `wp_review_gate_wait` when needed.
+- Call `review_gate` exactly once for the real plan version or delivery diff.
+- Observe the same durable operation with `review_gate_wait` when needed.
 - Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
 - If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
 
@@ -25,7 +25,7 @@ until independently verified.
   "purpose": "delivery",
   "base_ref": "<full-base-sha>",
   "authority_ref": "<full-head-sha>",
-  "provider": "codex",
+  "caller_model": "<your own model id, exactly as your host reports it>",
   "repository_access": "none",
 }
 ```
@@ -36,10 +36,15 @@ verdict with no new review and no new round. A partial approval, withheld becaus
 is incomplete (not every prior finding was briefed, or a briefed prior claim was marked
 still-open without a matching finding), grants no authority and spends no round.
 
-## Model policy
+## Reviewer selection
 
-When the user names an exact model, pass it in the MCP `model` field. Otherwise omit
-that field and let the MCP owner select the configured provider default.
+Pass `caller_model` with your OWN model id, exactly as your host reports it, and omit
+`provider`, `model`, and `effort`: the gate selects the reviewer route itself — a cross-family
+reviewer chosen for capability, current provider limits, and measured daily cost — and reports
+the choice in `policy_selection`. Never name a reviewer model, probe a provider CLI for its
+catalog, or read a credential store to discover models at invocation time; provider catalog
+discovery belongs to the snapshot drift workflow. An operator may still pass an explicit
+`provider`/`model` as a human override; agents must not.
 
 ## Review quality
 

package/skills/deep-interview/SKILL.md

@@ -59,7 +59,7 @@ Max rounds is a hard cap, not a target. Do not continue only to reach a round co
 - Treat every answer as a claim to pressure-test: the next question should usually demand evidence or an example, expose a hidden assumption, force a tradeoff or boundary, or reframe root cause vs symptom.
 - Do not rotate to a new dimension just for coverage when the current answer is still vague. Stay on the thread until it is one layer deeper, one assumption clearer, or one boundary tighter.
 - Before crystallizing, complete at least one explicit pressure pass that revisits an earlier answer with a deeper, assumption- or tradeoff-focused follow-up.
-- Gather codebase facts via local search tools, `wp_session_*` retrieval, and read-only repo inspection before asking the user about internals.
+- Gather codebase facts via local search tools, `session_*` retrieval, and read-only repo inspection before asking the user about internals.
 - Always run a preflight context intake before the first question.
 - For brownfield work, preflight must ground in docs before user-facing questions: inspect applicable `AGENTS.md`/`CLAUDE.md`, README/getting-started docs, relevant `docs/` contracts/plans/ADRs, existing blueprints under `blueprints/`, and any project glossary such as `UBIQUITOUS_LANGUAGE.md` when present.
 - Treat repo language as evidence, not authority: if the user uses a fuzzy, overloaded, or conflicting term, surface the specific doc/code wording and ask which meaning should govern.
@@ -82,17 +82,17 @@ Max rounds is a hard cap, not a target. Do not continue only to reach a round co
 ## Phase 0: Preflight Context Intake
 
 1. Parse `{{ARGUMENTS}}` and derive a short kebab-case task slug.
-2. Attempt to load the latest relevant context for the slug from session memory via the `wp_session_search`/`wp_session_retrieve` MCP tools.
+2. Attempt to load the latest relevant context for the slug from session memory via the `session_search`/`session_retrieve` MCP tools.
 3. If the provided initial context (or loaded snapshot) is too large for safe prompt use, the first round must ask for a concise prompt-safe summary before scoring ambiguity or any downstream handoff. This gate is blocking: preserve goals, constraints, success criteria, non-goals, decision boundaries, and references to the full source documents.
 4. If no snapshot exists, create a minimum snapshot with: task statement, desired outcome, stated solution, probable intent hypothesis, known facts/evidence, constraints, unknowns/open questions, decision-boundary unknowns, likely codebase touchpoints, repo docs/rules inspected, terminology/doc-code conflicts found.
 5. For brownfield tasks, inspect the applicable documentation/rule surface before the first user-facing round. Prefer exact, nearby sources: governing `AGENTS.md`/`CLAUDE.md`, README/getting-started docs, relevant `docs/` contracts/plans/ADRs, existing blueprints, and project glossary/context files when present.
-6. Capture the snapshot into session memory via `wp_session_capture` (tagged with the slug) and reference it in the interview state.
+6. Capture the snapshot into session memory via `session_capture` (tagged with the slug) and reference it in the interview state.
 
 ## Phase 1: Initialize
 
 1. Parse `{{ARGUMENTS}}` and the depth profile (`--quick|--standard|--deep`).
 2. Detect project context: use local search tools and read-only repo inspection to classify **brownfield** (existing codebase target) vs **greenfield**; for brownfield, collect relevant context before questioning.
-3. Persist a lightweight resumable interview state to session memory via `wp_session_capture` (interview id, profile, type, initial idea, rounds, current ambiguity, threshold, max rounds, challenge modes used, current stage/focus, context snapshot reference), so a later session can resume via `wp_session_search`/`wp_session_restore`.
+3. Persist a lightweight resumable interview state to session memory via `session_capture` (interview id, profile, type, initial idea, rounds, current ambiguity, threshold, max rounds, challenge modes used, current stage/focus, context snapshot reference), so a later session can resume via `session_search`/`session_restore`.
 4. Announce kickoff with the profile, threshold, and current ambiguity.
 
 ## Phase 2: Socratic Interview Loop
@@ -178,7 +178,7 @@ Show the weighted breakdown table, readiness-gate status (`Non-goals`, `Decision
 
 ### 2e) Persist state
 
-Append the round result and updated scores to the slug-tagged interview state in session memory (`wp_session_capture`).
+Append the round result and updated scores to the slug-tagged interview state in session memory (`session_capture`).
 
 ### 2f) Round controls
 
@@ -203,9 +203,9 @@ Track used modes in state to prevent repetition.
 
 When the threshold is met (or the user exits with warning / hard cap):
 
-1. Create or update the versioned draft that owns this task with `wp_blueprint_put`, yielding `blueprints/draft/{slug}/`. In this repo, deep interviews exist to produce better blueprints before implementation; carry the returned `bpv1:` version through every replacement.
+1. Create or update the versioned draft that owns this task with `blueprint_put`, yielding `blueprints/draft/{slug}/`. In this repo, deep interviews exist to produce better blueprints before implementation; carry the returned `bpv1:` version through every replacement.
 2. Write the interview transcript summary to `blueprints/draft/{slug}/interview.md`.
-3. Fold the execution-ready spec into `blueprints/draft/{slug}/_overview.md` (intent, scope, non-goals, decision boundaries, constraints, acceptance criteria), and capture a copy of the final spec + scores into session memory via `wp_session_capture`.
+3. Fold the execution-ready spec into `blueprints/draft/{slug}/_overview.md` (intent, scope, non-goals, decision boundaries, constraints, acceptance criteria), and capture a copy of the final spec + scores into session memory via `session_capture`.
 
 The spec should include: metadata (profile, rounds, final ambiguity, threshold, context type); context snapshot reference; prompt-safe initial-context summary when oversized context was provided, plus references to the full sources; the clarity breakdown table; Intent (why); Desired Outcome; In-Scope; Out-of-Scope / Non-goals; Decision Boundaries (what the agent may decide without confirmation); Constraints; testable acceptance criteria (prefer repo verification surfaces — `wp test`, `wp typecheck`, `wp audit` — over manual checks); assumptions exposed and their resolutions; pressure-pass findings (which answer was revisited and what changed); brownfield evidence-vs-inference notes; the Docs/Terminology Ledger; scenario/edge-case findings that shaped scope or acceptance; and the full or condensed transcript.
 
@@ -219,7 +219,7 @@ Present execution options after artifact generation using explicit handoff contr
 - **`autopilot`** — when the spec is already strong enough for direct planning plus execution. Consumer uses the spec as the clarified execution brief with the non-goals and acceptance criteria as binding context.
 - **`ultragoal`** — when the clarified work should become durable, sequentially tracked goal-mode work.
 - **`team`** — when the task is large, multi-lane, or blocker-sensitive enough to justify coordinated parallel execution.
-- **Blueprint lifecycle** — refine with `wp_blueprint_put`, review the exact version with `wp_review_gate`, and inspect the auto-promoted result with `wp_blueprint_get` when work should enter planned execution directly.
+- **Blueprint lifecycle** — refine with `blueprint_put`, review the exact version with `review_gate`, then promote the approved version explicitly with `blueprint_promote` when work should enter planned execution directly (MCP `review_gate` never auto-promotes).
 - **Refine further** — re-enter the loop to resolve the highest-leverage remaining uncertainty when residual ambiguity is still too high or an early-exit/above-threshold warning indicates too much risk to proceed cleanly.
 
 For research-shaped requests (a research question, evaluator-backed analysis, or reference gathering), hand off to `autoresearch` after the interview converges on a validator-ready mission; keep the explicit `refine further` vs `launch` boundary and do not launch until the user confirms.
@@ -232,11 +232,11 @@ For research-shaped requests (a research question, evaluator-backed analysis, or
 
 <Tool_Usage>
 
-- Use local search tools, `wp_session_*` retrieval, and read-only repo inspection for codebase fact gathering.
+- Use local search tools, `session_*` retrieval, and read-only repo inspection for codebase fact gathering.
 - Use the host's native structured-question tool (e.g. `AskUserQuestion`) for each round when available; otherwise ask one concise plain-text question and wait.
-- Keep context snapshots and resumable interview state in session memory via the `wp_session_*` MCP tools, tagged with the task slug.
+- Keep context snapshots and resumable interview state in session memory via the `session_*` MCP tools, tagged with the task slug.
 - Read applicable repo docs/rules/context during preflight; write durable docs/glossary/ADR updates only when the user explicitly opts in and the content is public-safe.
-- Land transcript artifacts in the active task's blueprint folder; create/update `_overview.md` only through `wp_blueprint_put`.
+- Land transcript artifacts in the active task's blueprint folder; create/update `_overview.md` only through `blueprint_put`.
 - Use `best-practice-research` when unresolved ambiguity depends on current external/upstream guidance.
   </Tool_Usage>
 
@@ -250,7 +250,7 @@ For research-shaped requests (a research question, evaluator-backed analysis, or
 
 <Final_Checklist>
 
-- [ ] Preflight context snapshot captured to session memory (`wp_session_capture`, slug-tagged)
+- [ ] Preflight context snapshot captured to session memory (`session_capture`, slug-tagged)
 - [ ] Oversized initial context, if present, has a prompt-safe summary before scoring or handoff
 - [ ] Ambiguity score shown each round
 - [ ] Intent-first stage priority used before implementation detail
@@ -260,7 +260,7 @@ For research-shaped requests (a research question, evaluator-backed analysis, or
 - [ ] Challenge modes triggered at thresholds (when applicable)
 - [ ] `Non-goals` and `Decision Boundaries` explicit before handoff
 - [ ] Transcript written to `blueprints/draft/{slug}/interview.md`
-- [ ] Spec folded into `blueprints/draft/{slug}/_overview.md` through `wp_blueprint_put`
+- [ ] Spec folded into `blueprints/draft/{slug}/_overview.md` through `blueprint_put`
 - [ ] Brownfield questions use evidence-backed confirmation and doc grounding when applicable
 - [ ] Fuzzy/conflicting terminology challenged against repo language when applicable
 - [ ] Handoff options provided (`ralplan`, `autopilot`, `ultragoal`, `team`, blueprint lifecycle)

package/skills/delivery-program/SKILL.md

@@ -28,14 +28,14 @@ Child membership comes only from `parent_roadmap`; do not maintain a second list
 
 ## Loop
 
-1. Call `wp_delivery_status({ slug })`.
+1. Call `delivery_status({ slug })`.
 2. Treat its `version`, blockers, and exact returned action as the current derived
    truth. Do not reconstruct state from transcripts.
-3. Dispatch only returned `wp_worktree` actions. Child work starts from the
+3. Dispatch only returned `worktree` actions. Child work starts from the
    delivery branch and child PRs target that branch.
 4. Integrate at most one child at a time. Recheck status immediately before
-   calling `wp_pr_merge` with the exact returned head SHA.
-5. An `enqueued` merge is not integrated. Call `wp_delivery_status` again and
+   calling `pr_merge` with the exact returned head SHA.
+5. An `enqueued` merge is not integrated. Call `delivery_status` again and
    wait for the merged postcondition.
 6. After every child PR is merged, verify the delivery branch and land its final
    PR to `delivery_base` through the same exact-SHA merge tool.