godpowers 1.6.1 → 1.6.3

package/CHANGELOG.md

@@ -5,6 +5,58 @@ All notable changes to Godpowers will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.6.3] - 2026-05-16
+
+Safe sync routing patch. Keeps the 1.6 command surface stable while making
+`/god-next` and `/god-deploy` honor unresolved release sync blockers before
+Tier 3 work.
+
+### Added
+- Added router detection for `.godpowers/sync/SAFE-SYNC-PLAN.md`.
+- Added router detection for checkpoint text that marks safe sync as a
+  blocking red gate.
+- Added `safe-sync-clear` prerequisite support for routing files.
+- Added regression tests for safe sync plan blockers, checkpoint blockers,
+  deploy prerequisites, and resolved safe sync plans.
+
+### Changed
+- `/god-next` now suggests `/god-reconcile Release Truth And Safe Sync` before
+  `/god-deploy` when safe sync remains unresolved.
+- `/god-deploy` now advertises the safe sync reconcile command as its
+  auto-complete route when the gate is red.
+
+### Guardrails
+- This patch does not add slash commands, agents, workflows, recipes, schemas,
+  or public artifact formats.
+- The blocker clears only when `.godpowers/sync/SAFE-SYNC-DONE.md` or
+  `.godpowers/sync/SAFE-SYNC-RESOLVED.md` exists.
+
+## [1.6.2] - 2026-05-16
+
+Codex agent metadata compatibility patch. Keeps the public command surface
+stable while making installed Godpowers specialist agents spawnable in Codex
+sessions that require per-agent TOML metadata.
+
+### Added
+- Added Codex agent metadata generation during `--codex` installs. Every
+  `agents/god-*.md` file now gets a matching `god-*.toml` file with name,
+  description, sandbox mode, and developer instructions.
+- Added install smoke coverage that verifies all 39 Godpowers agents receive
+  Codex metadata.
+- Added `--all` installer coverage for all 15 supported runtimes, including
+  Claude Code, Codex, and Pi.
+
+### Changed
+- Codex runtime support now declares its agent metadata behavior explicitly in
+  the installer instead of relying on an inline special case.
+- Non-Codex runtimes keep their existing markdown agent install format.
+
+### Guardrails
+- This patch does not add slash commands, agents, workflows, recipes, schemas,
+  or public artifact formats.
+- The Codex metadata is generated from the existing agent markdown specs so the
+  Godpowers agent source of truth stays in `agents/*.md`.
+
 ## [1.6.1] - 2026-05-15
 
 Release hardening patch. Keeps the 1.6 domain precision surface stable while

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-1.6.1-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-1.6.3-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -12,9 +12,10 @@ idea to hardened production. It runs as **slash commands inside your AI coding
 tool** (Claude Code, Codex, Cursor, etc.) that orchestrate **specialist agents**
 in fresh contexts to do the work.
 
-Version 1.6.1 hardens the release path around the 1.6 domain precision layer:
-release checks now cover tests, audit, package contents, E2E smoke, and npm
-payload verification before publishing.
+Version 1.6.3 hardens Godpowers routing around release truth and safe sync:
+`/god-next` now routes unresolved safe-sync blockers to
+`/god-reconcile Release Truth And Safe Sync` before deploy-era work, while
+Codex installs keep per-agent TOML metadata for all 39 specialist agents.
 
 It fuses four disciplines into one unified workflow:
 
@@ -46,6 +47,7 @@ T3 Code is transparently supported through the underlying agent.
 The installer copies:
 - Slash command skills to `<runtime>/skills/`
 - Specialist agents to `<runtime>/agents/`
+- Codex agent metadata to `<runtime>/agents/*.toml`
 - SessionStart hook (Claude Code only) to `<runtime>/hooks/`
 
 ## Usage

package/RELEASE.md

@@ -1,11 +1,10 @@
-# Godpowers 1.6.1 Release
+# Godpowers 1.6.3 Release
 
-Date: 2026-05-15
+Date: 2026-05-16
 
-Godpowers 1.6.1 hardens the release and package path around the 1.6 domain
-precision release. The goal of this patch is to make tests, audit checks,
-package contents, E2E smoke coverage, npm publishing, and GitHub release
-metadata easier to verify before anything reaches users.
+Godpowers 1.6.3 hardens release-truth routing around the stable 1.6 surface.
+The goal of this patch is to make `/god-next` and `/god-deploy` honor safe
+sync blockers before Tier 3 work, without changing the public command surface.
 
 ## What is stable
 
@@ -14,6 +13,8 @@ metadata easier to verify before anything reaches users.
 - 13 executable workflows
 - 36 intent recipes
 - 15-runtime installer
+- Codex installs with 39 generated `god-*.toml` agent metadata files
+- Safe-sync routing before deploy, observe, harden, or launch work
 - Native Pillars project context through `AGENTS.md` and `agents/*.md`
 - `.godpowers/` workflow state and artifact layout
 - Core schemas: intent, state, events, workflow, routing, recipes, extension
@@ -24,24 +25,20 @@ metadata easier to verify before anything reaches users.
 
 ## What is new
 
-- `npm run release:check` now runs tests, audit checks, and package contents
-  verification as a single pre-release gate.
-- `npm run pack:check` now asserts required npm payload files and rejects
-  local-only files instead of relying on visual dry-run output.
-- CI now installs with `npm ci`, runs audit checks, runs E2E smoke explicitly,
-  and keeps package validation tied to local scripts.
-- `docs/RELEASE-CHECKLIST.md` documents the expected release flow, tag flow,
-  npm provenance path, and post-release verification.
-- `/god-mode` full-arc has a plan-mode E2E smoke test that verifies 10 jobs,
-  7 waves, and a generated `.godpowers/runs/.../plan.yaml` artifact.
-- Stale placeholder docs for runtime libraries, references, and test strategy
-  now describe the implemented system.
-
-## What 1.6.1 means
-
-Godpowers 1.6.1 does not expand the public command surface. It tightens the
-release discipline around the existing surface so local checks, CI checks, npm
-payload contents, git tags, and GitHub release metadata agree.
+- `/god-next` detects `.godpowers/sync/SAFE-SYNC-PLAN.md` and routes to
+  `/god-reconcile Release Truth And Safe Sync` before `/god-deploy`.
+- `/god-next` also detects checkpoint text that marks safe sync as a blocking
+  red gate before deploy.
+- `/god-deploy` has a `safe-sync-clear` prerequisite with the same reconcile
+  route as its auto-complete command.
+- Router tests now cover unresolved safe sync plans, checkpoint blockers,
+  deploy prerequisite failure, and resolved safe sync plans.
+
+## What 1.6.3 means
+
+Godpowers 1.6.3 does not expand the public command surface. It tightens the
+runtime decision path so project truth can override the structural tier order
+when a safe-sync gate is still red.
 
 The domain glossary remains preparation context. PRD, ARCH, ROADMAP, STACK,
 docs, and Pillars files still carry durable decisions for their own domains.
@@ -51,8 +48,8 @@ docs, and Pillars files still carry durable decisions for their own domains.
 During the 1.x stability window, do not add broad new command families, change
 schema formats, or rename public artifacts without evidence from real use.
 
-The `v1.6.1` git tag points to the release commit that matches the npm
-`godpowers@1.6.1` package. Public publishes should prefer the tag-triggered
+The `v1.6.3` git tag points to the release commit that matches the npm
+`godpowers@1.6.3` package. Public publishes should prefer the tag-triggered
 GitHub workflow so npm provenance, git history, and release notes stay aligned.
 
 Allowed changes:

package/bin/install.js

@@ -36,6 +36,7 @@ const RUNTIMES = {
     configDir: path.join(os.homedir(), '.codex'),
     skillsDir: 'skills',
     configFile: 'config.toml',
+    agentMetadata: 'toml',
   },
   cursor: {
     name: 'Cursor',
@@ -182,6 +183,84 @@ function installSkillFile(srcFile, skillsDest, runtimeKey, targetName = null) {
   fs.copyFileSync(srcFile, path.join(skillsDest, `${baseName}.md`));
 }
 
+function parseAgentFrontmatter(content) {
+  const fallback = { name: null, description: null };
+  if (!content.startsWith('---\n')) return fallback;
+
+  const end = content.indexOf('\n---', 4);
+  if (end === -1) return fallback;
+
+  const lines = content.slice(4, end).split('\n');
+  const parsed = { ...fallback };
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const nameMatch = line.match(/^name:\s*(.+)\s*$/);
+    if (nameMatch) {
+      parsed.name = nameMatch[1].replace(/^["']|["']$/g, '');
+      continue;
+    }
+
+    if (line === 'description: |') {
+      const desc = [];
+      i++;
+      while (i < lines.length && /^ {2}/.test(lines[i])) {
+        desc.push(lines[i].slice(2));
+        i++;
+      }
+      i--;
+      parsed.description = desc.join('\n').trim();
+      continue;
+    }
+
+    const descMatch = line.match(/^description:\s*(.+)\s*$/);
+    if (descMatch) {
+      parsed.description = descMatch[1].replace(/^["']|["']$/g, '');
+    }
+  }
+
+  return parsed;
+}
+
+function stripFrontmatter(content) {
+  if (!content.startsWith('---\n')) return content.trim();
+  const end = content.indexOf('\n---', 4);
+  if (end === -1) return content.trim();
+  return content.slice(end + 4).trim();
+}
+
+function tomlString(value) {
+  return JSON.stringify(value || '');
+}
+
+function tomlLiteral(value) {
+  return `'''\n${(value || '').replace(/'''/g, "'''\\'''")}\n'''`;
+}
+
+function writeCodexAgentToml(srcFile, agentsDest) {
+  const content = fs.readFileSync(srcFile, 'utf8');
+  const frontmatter = parseAgentFrontmatter(content);
+  const name = frontmatter.name || path.basename(srcFile, '.md');
+  const description = frontmatter.description || `Godpowers specialist agent: ${name}.`;
+  const instructions = stripFrontmatter(content);
+  const toml = [
+    `name = ${tomlString(name)}`,
+    `description = ${tomlString(description)}`,
+    'sandbox_mode = "workspace-write"',
+    `developer_instructions = ${tomlLiteral(instructions)}`,
+    ''
+  ].join('\n');
+
+  fs.writeFileSync(path.join(agentsDest, `${name}.toml`), toml);
+}
+
+function installAgentFile(srcFile, agentsDest, runtime) {
+  fs.copyFileSync(srcFile, path.join(agentsDest, path.basename(srcFile)));
+  if (runtime.agentMetadata === 'toml') {
+    writeCodexAgentToml(srcFile, agentsDest);
+  }
+}
+
 function removeSkillEntry(skillsDir, entry) {
   const entryPath = path.join(skillsDir, entry.name);
   if (entry.isDirectory()) {
@@ -289,11 +368,13 @@ function installForRuntime(runtimeKey, srcDir) {
     let count = 0;
     for (const file of fs.readdirSync(agentsSrc)) {
       if (file.endsWith('.md')) {
-        fs.copyFileSync(path.join(agentsSrc, file), path.join(agentsDest, file));
+        const srcFile = path.join(agentsSrc, file);
+        installAgentFile(srcFile, agentsDest, runtime);
         count++;
       }
     }
-    success(`Installed ${count} specialist agents to agents/`);
+    const shape = runtime.agentMetadata === 'toml' ? 'agents/ with Codex metadata' : 'agents/';
+    success(`Installed ${count} specialist agents to ${shape}`);
   }
 
   // 3. Install the master SKILL.md (always-on context)

package/lib/router.js

@@ -14,6 +14,11 @@ const { parseSimpleYaml } = require('./intent');
 const state = require('./state');
 
 const ROUTING_DIR = path.join(__dirname, '..', 'routing');
+const SAFE_SYNC_PLAN = '.godpowers/sync/SAFE-SYNC-PLAN.md';
+const SAFE_SYNC_DONE_FILES = [
+  '.godpowers/sync/SAFE-SYNC-DONE.md',
+  '.godpowers/sync/SAFE-SYNC-RESOLVED.md'
+];
 
 let _cache = null;
 
@@ -107,6 +112,10 @@ function evaluateCheck(check, projectRoot) {
     return actual === expected || actual === parseValue(expected);
   }
 
+  if (check === 'safe-sync-clear') {
+    return detectSafeSyncBlocker(projectRoot) === null;
+  }
+
   // mode-A-greenfield: pass-through hint, treat as satisfiable
   if (check.includes('greenfield') || check.includes('mode-A')) {
     return !fs.existsSync(path.join(projectRoot, '.godpowers'));
@@ -236,6 +245,9 @@ function suggestNext(projectRoot) {
   if (subStepStatus(tiers, 'tier-2', 'build') !== 'done')
     return { command: '/god-build', reason: 'Build pending', tier: 'tier-2' };
 
+  const safeSync = detectSafeSyncBlocker(projectRoot);
+  if (safeSync) return safeSync;
+
   // Tier 3
   if (subStepStatus(tiers, 'tier-3', 'deploy') !== 'done')
     return { command: '/god-deploy', reason: 'Deploy pipeline not set up', tier: 'tier-3' };
@@ -258,6 +270,39 @@ function subStepStatus(tiers, tierKey, subKey) {
   return tiers[tierKey] && tiers[tierKey][subKey] && tiers[tierKey][subKey].status;
 }
 
+function detectSafeSyncBlocker(projectRoot) {
+  if (SAFE_SYNC_DONE_FILES.some(file => fs.existsSync(path.join(projectRoot, file)))) {
+    return null;
+  }
+
+  const planPath = path.join(projectRoot, SAFE_SYNC_PLAN);
+  if (fs.existsSync(planPath)) {
+    return safeSyncSuggestion(`Unresolved safe sync plan at ${SAFE_SYNC_PLAN}`, SAFE_SYNC_PLAN);
+  }
+
+  const checkpointPath = path.join(projectRoot, '.godpowers', 'CHECKPOINT.md');
+  if (!fs.existsSync(checkpointPath)) return null;
+
+  const checkpoint = fs.readFileSync(checkpointPath, 'utf8');
+  const mentionsSafeSync = /safe sync/i.test(checkpoint);
+  const isBlocking = /block|red gate|missing|unresolved|before deploy|blocks deploy/i.test(checkpoint);
+  if (mentionsSafeSync && isBlocking) {
+    return safeSyncSuggestion('Checkpoint says safe sync is blocking Tier 3 work', '.godpowers/CHECKPOINT.md');
+  }
+
+  return null;
+}
+
+function safeSyncSuggestion(reason, evidence) {
+  return {
+    command: '/god-reconcile Release Truth And Safe Sync',
+    reason,
+    tier: 'tier-0',
+    blocker: 'safe-sync',
+    evidence
+  };
+}
+
 /**
  * Clear cached routing (for tests).
  */
@@ -275,5 +320,6 @@ module.exports = {
   getSpawnedAgents,
   suggestNext,
   evaluateCheck,
+  detectSafeSyncBlocker,
   clearCache
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "godpowers",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "description": "AI-powered development system: 106 slash commands and 39 specialist agents that take a project from raw idea to hardened production. Runs inside Claude Code, Codex, Cursor, Windsurf, Gemini, and 10+ other AI coding tools.",
   "bin": {
     "godpowers": "./bin/install.js"

package/routing/god-deploy.yaml

@@ -10,6 +10,9 @@ prerequisites:
     - check: state:tier-2.build.status == done
       auto-complete: /god-build
       human-required: true
+    - check: safe-sync-clear
+      auto-complete: /god-reconcile Release Truth And Safe Sync
+      human-required: true
 
 execution:
   spawns: [god-deploy-engineer]

package/skills/god-doctor.md

@@ -48,7 +48,7 @@ GODPOWERS DOCTOR
 Install: claude (~/.claude/)
   [OK] 106 skills installed
   [OK] 39 agents installed
-  [OK] VERSION matches (1.6.1)
+  [OK] VERSION matches (1.6.3)
   [WARN] routing/god-doctor.yaml exists but skill file did not until now
 
 Project: /Users/.../my-project/.godpowers/

package/skills/god-next.md

@@ -135,6 +135,7 @@ Use <runtimeRoot>/lib/router.js suggestNext(projectRoot)  <- structural next
 For each tier in order:
    - Find first non-done sub-step
    - That's the suggested next command
+   - Before Tier 3, honor red gates such as unresolved safe sync
    |
    v
 If all tiers done:
@@ -232,6 +233,15 @@ Display both with: "Run in any order. /god-roadmap is critical-path."
 ### State drift (artifact missing but state says done)
 Detected by lib/state.detectDrift(). Suggest /god-repair.
 
+### Safe sync blocks deploy
+If `.godpowers/sync/SAFE-SYNC-PLAN.md` exists, or `.godpowers/CHECKPOINT.md`
+states that safe sync is a blocking red gate, suggest
+`/god-reconcile Release Truth And Safe Sync` before `/god-deploy`,
+`/god-observe`, `/god-harden`, or `/god-launch`.
+
+The blocker is cleared when `.godpowers/sync/SAFE-SYNC-DONE.md` or
+`.godpowers/sync/SAFE-SYNC-RESOLVED.md` exists.
+
 ### Steady state with multiple workflow options
 If lifecycle-phase = steady-state-active, route by user intent if provided
 (use the User Intent Map below).

package/skills/god-version.md

@@ -14,7 +14,7 @@ Print version and a short capability summary.
 ## Output
 
 ```
-Godpowers v1.6.1
+Godpowers v1.6.3
 Install: /Users/.../.claude/  (matches package.json)
 Surface: 106 skills, 39 agents, 13 workflows, 36 recipes
 Schema: intent.v1, state.v1, events.v1, workflow.v1, routing.v1, recipe.v1