oh-my-customcode 0.178.0 → 0.180.0

package/README.md

@@ -13,7 +13,7 @@
 
 **[한국어 문서 (Korean)](./README_ko.md)**
 
-49 agents. 116 skills. 23 rules. One command.
+49 agents. 117 skills. 23 rules. One command.
 
 ```bash
 npm install -g oh-my-customcode && cd your-project && omcustom init
@@ -132,13 +132,13 @@ Each agent declares its tools, model, memory scope, and limitations in YAML fron
 
 ---
 
-### Skills (116)
+### Skills (117)
 
 | Category | Count | Includes |
 |----------|-------|----------|
 | Best Practices | 24 | Go, Python, TypeScript, Kotlin, Rust, React, FastAPI, Spring Boot, Django, Flutter, Docker, AWS, Postgres, Redis, Kafka, dbt, Spark, Snowflake, Airflow, pipeline-architecture-patterns, alembic, and more |
 | Routing | 4 | secretary, dev-lead, de-lead, qa-lead |
-| Workflow | 13 | structured-dev-cycle, deep-plan, research, evaluator-optimizer, dag-orchestration, worker-reviewer-pipeline, reasoning-sandwich, pipeline, and more |
+| Workflow | 14 | structured-dev-cycle, deep-plan, research, evaluator-optimizer, dag-orchestration, worker-reviewer-pipeline, reasoning-sandwich, pipeline, fsd, and more |
 | Development | 8 | dev-review, dev-refactor, analysis, create-agent, intent-detection, web-design-guidelines, omcustom-takeover, skill-extractor |
 | Operations | 9 | update-docs, audit-agents, sauron-watch, monitoring-setup, fix-refs, release-notes, and more |
 | Memory | 3 | memory-save, memory-recall, memory-management |
@@ -270,7 +270,7 @@ your-project/
 ├── CLAUDE.md                   # Entry point
 ├── .claude/
 │   ├── agents/                 # 49 agent definitions
-│   ├── skills/                 # 116 skill modules
+│   ├── skills/                 # 117 skill modules
 │   ├── rules/                  # 23 governance rules (R000-R023)
 │   ├── hooks/                  # 15 lifecycle hook scripts
 │   ├── schemas/                # Tool input validation schemas

package/dist/cli/index.js

@@ -241,7 +241,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "0.178.0",
+    version: "0.180.0",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2031,7 +2031,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "0.178.0",
+  version: "0.180.0",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "0.178.0",
+  "version": "0.180.0",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/rules/MUST-completion-verification.md

@@ -200,6 +200,19 @@ triage-dispatch.yml 실패 원인을 파일 Read 전에 "triaged 라벨 부재 +
 
 Origin: #1266 ④.
 
+### Proxy Signal vs Canonical Ground-Truth (#1336 ①②)
+
+> Origin: #1336 ①② — transcription was alarmed as "stopped" because `.txt` files looked stale, but the canonical DB had transcripts current to 06-09 21:30 (.txt is not the whisper collector's output — it emits only to the DB). Separately, SMS was over-diagnosed as "fully blocked" from one empty OneDrive XML path + a single 401, while the DB held 17 SMS rows ingested via the app path.
+
+When diagnosing pipeline/data state, verify the CANONICAL store (the authoritative datastore — DB, the system of record) BEFORE characterizing state from a secondary proxy (a `.txt`/file artifact) or a single ingestion path. Two failure modes share this meta-pattern:
+
+| Anti-pattern | Required |
+|--------------|----------|
+| Characterize pipeline health from a filesystem proxy (`.txt` presence/mtime) | Query the canonical store (DB transcript count/recency) first |
+| Generalize one ingestion path's failure (one empty XML / one 401) to "whole pipeline blocked" | Check the final landing store's count across ALL paths before concluding blockage |
+
+A single path's failure does NOT prove the whole multi-path pipeline is down. Confirm the system-of-record before alarming or dispatching reprocessing.
+
 ### Directory-Context Before Multi-Copy Unification/Deletion
 
 다중 사본(동일 파일이 N곳에 존재)을 통일하거나 삭제하기 전, 각 사본이 위치한 **디렉토리 전체 맥락**을 확인한다(`ls`로 형제 파일 파악). 사본 파일 하나만 보고 "orphan"·"stub"으로 특성화하면, 같은 디렉토리의 형제 파일(다른 역할을 가진)이 함께 덮이거나 맥락이 누락된다. Read-Before-Characterize를 파일 단위에서 디렉토리 단위로 확장한 규칙이다.
@@ -256,6 +269,21 @@ A CI publish/deploy step that LOGS an error has NOT necessarily failed — the s
 
 This is the publish-domain extension of Read-Before-Characterize ("actual outcome ≠ attempt"). Re-running a publish that actually succeeded risks duplicate-publish errors; permanently changing a workflow on a misdiagnosis is worse (cf. #1217 — npm E403 misdiagnosed as a `--provenance` conflict → wrong workflow change → repeated failure; real cause was token scope).
 
+### State-Change Claim → Live System Verification (#1335 ①)
+
+> Origin: #1335 ① — issue #101 (secretary teardown) was closed as "대체 완료·teardown 보류", but the secretary LaunchAgents (onedrive-bridge / calendar-worker / minikube-mount) were STILL running on the host. The user caught it ("secretary 리소스 다 내려가있는거 맞지?") — they were not.
+
+Before closing or marking-done an issue/task that CLAIMS an infrastructure or resource STATE change (a service stopped, a resource torn down, a deployment removed, a process killed), verify the ACTUAL live system state — not just that the change command was issued. "Issued the teardown" ≠ "the resource is down".
+
+| Claimed state change | Live ground-truth check |
+|----------------------|-------------------------|
+| LaunchAgent/service stopped | `launchctl list` / `systemctl status` shows it absent/inactive |
+| k8s resource torn down | `kubectl get <resource>` returns NotFound |
+| Container removed | `docker ps -a` does not list it |
+| Process killed | process check (`pgrep`/`ps`) returns empty |
+
+This is the infra/state extension of "actual outcome ≠ attempt". Closing on the command-issued assumption leaves orphaned running resources.
+
 ## Integration
 
 | Rule | Interaction |

package/templates/.claude/rules/MUST-parallel-execution.md

@@ -192,3 +192,15 @@ The list form mirrors the tool-call `[N]` prefix pattern and scales better to 3+
   ✓ agent-1: success
   ✗ agent-2: failed (reason)
 ```
+
+## Parallel Feature Integration Gate
+
+> Origin: #1335 ③ — parallel lang-kotlin-expert rounds each reported "build green", but the COMBINED runtime had a DataStore singleton crash, a Settings→Dashboard nav crash, a recording 400, and cursor pre-advance bugs — caught only by on-device testing.
+
+Per-subagent "build green" does NOT guarantee integrated runtime correctness. When parallel feature subagents edit interdependent code, the orchestrator MUST run an INTEGRATION verification gate after the parallel work merges — a combined build PLUS a runtime/smoke check (or device test for apps) — before declaring the feature done. Independent green builds can still combine into runtime crashes (shared singletons, navigation, API contracts).
+
+| Anti-pattern | Required |
+|--------------|----------|
+| Trust each parallel subagent's "build green" and declare done | Orchestrator runs a combined build + runtime/smoke gate on the merged result first |
+
+Cross-reference: R020 (actual outcome ≠ attempt; completion verification).

package/templates/.claude/rules/MUST-safety.md

@@ -70,6 +70,30 @@ Prefer a reversible action (disable/detach/stop) over delete when the goal can b
 
 > **Ask-before-scan (#1327 찐빠 #4)**: When a credential/token is needed, request it from the user BEFORE running BLIND/DISCOVERY credential scans (`env | grep`, repo-wide token greps), which trip the Credential Exploration classifier. Reading a SPECIFIC file the user named to obtain a value is not a discovery scan and is fine. If a scan trips the classifier, do not retry it (R010 Subagent Scope-Creep STOP Protocol).
 
+### Infra-Diagnostic File Checks — Metadata, Not Contents (#1334 ①)
+
+> Origin: #1334 ① — during a hermes 502 diagnosis, a `cat .env` + `credentials.json` key inspect was reflexively bundled into a diagnostic batch and tripped the Credential Exploration classifier. The secret values were never needed for the 502 diagnosis.
+
+When diagnosing infrastructure/health issues (502s, container state, env presence), file checks MUST use metadata-only commands — `ls -la` (existence, size, perms, mtime) — NEVER `cat .env`, `cat credentials.json`, or any command that reads secret CONTENTS or keys into the transcript. Confirming a file EXISTS is a metadata check; reading its values is a credential scan.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| `cat .env` / inspect OAuth/credential keys to "confirm config present" during a health diagnosis | `ls -la .env` — existence/size/perms only; request a specific value from the user if genuinely needed |
+
+Cross-reference: the Ask-before-scan note above (discovery scans), R010 Subagent Scope-Creep STOP.
+
+### Standing User-Deny + Classifier Block → Immediate user-runs Switch (#1335 ④)
+
+> Origin: #1335 ④ — with a standing user constraint "절대 시크릿 건드리지 마" plus a classifier block, an `.env.local` edit (DATABASE_URL, LLM_MAX_TOKENS) was retried and blocked repeatedly instead of handing the edit to the user.
+
+When the user has a STANDING "don't touch X" constraint AND the safety classifier blocks an action on X even once, immediately switch to the `!` user-runs pattern — surface the exact command for the user to run themselves — and do NOT retry the blocked edit. A standing deny + one classifier trip is a hard signal to delegate to the user, not to find another path in.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| Retry a blocked edit on a user-deny-listed path via a different mechanism | Stop after the first block; emit the command for the user to run via `!` and wait |
+
+Cross-reference: R010 Subagent Scope-Creep STOP Protocol (2-trip stop), R015 Failed Tool Re-Try Discipline.
+
 Cross-reference: R010 Subagent Scope-Creep STOP Protocol, R002 (permission tiers).
 
 ## Required Before Destructive Operations

package/templates/.claude/rules/SHOULD-memory-integration.md

@@ -21,6 +21,18 @@ Agent frontmatter `memory: project|user|local` enables persistent memory:
 | `project` | `.claude/agent-memory/<name>/` | Yes |
 | `local` | `.claude/agent-memory-local/<name>/` | No |
 
+## Subagent memory:project Source-Tree Pollution Guard
+
+> Origin: #1335 ② — lang-kotlin-expert with `memory: project`, working in a Kotlin source subdirectory, wrote memory to `mobile/.../com/baekenough/secondbrain/.claude/agent-memory/` — INSIDE the source package. Caught and removed just before commit.
+
+A subagent with `memory: project` working in a SUBDIRECTORY can create `.claude/agent-memory/` relative to its current working directory, polluting the source tree (e.g., inside a source package). Memory MUST resolve to the PROJECT ROOT `.claude/`, never a nested working dir.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| Accept a subagent's `.claude/agent-memory/` written under a source package | Verify memory writes land at project-root `.claude/`; remove any nested `.claude/agent-memory/` from source dirs before commit |
+
+Check for nested `.claude/agent-memory/` (e.g., `find . -path '*/src/*/.claude' -o -path '*/main/*/.claude'`) before committing subagent work.
+
 ## Best Practices
 
 - Consult memory before starting work

package/templates/.claude/skills/fsd/SKILL.md

@@ -0,0 +1,147 @@
+---
+name: omcustom:fsd
+description: Full Self Driving — autonomous release loop that processes all auto-dev-eligible GitHub issues until none remain, by repeatedly running /pipeline auto-dev then /homework.
+scope: harness
+user-invocable: true
+argument-hint: "[<max-releases>]"
+version: 0.1.0
+effort: high
+---
+
+# /omcustom:fsd — Full Self Driving
+
+Autonomous release loop. Equivalent to running:
+
+```
+/goal "모든 이슈가 처리될 때까지" /loop "/pipeline auto-dev -> /homework"
+```
+
+This is a **thin alias / orchestrator skill**. It does not implement loop, issue-polling, release, or verification logic — it delegates entirely to existing skills.
+
+## Usage
+
+```
+/omcustom:fsd               # Run until all auto-dev-eligible issues are exhausted
+/omcustom:fsd 3             # Optional: cap at N releases (default: unlimited)
+```
+
+No arguments are required. The default behavior runs until the auto-dev-eligible issue set is empty.
+
+## What It Does
+
+FSD expands into:
+
+1. **`/goal` wrapper** — applies disciplined goal-to-execution workflow:
+   - Objective: "모든 이슈가 처리될 때까지"
+   - Delegates planning, gap detection, and R020 completion verification to the `goal` skill
+2. **`/loop` recurrence** — self-paced loop (model decides cadence), each iteration runs:
+   1. `/pipeline auto-dev` — full release pipeline for the next eligible issue
+   2. `/homework` — retrospective 찐빠 audit gate
+
+### Loop Convergence
+
+The loop converges naturally when the auto-dev-eligible issue set reaches 0. Issue eligibility follows `/pipeline auto-dev` label selection exactly:
+
+- **Included**: `verify-ready` (preferred), unlabeled auto-dev candidates
+- **Excluded**: `verify-done`, `needs-review`, `decision-needed` labels
+
+Do NOT invent new label logic here — defer to the `pipeline` skill's auto-dev issue selection.
+
+### Iteration Flow (per iteration)
+
+```
+[FSD Iteration N]
+├── /pipeline auto-dev        → one release (PR create → merge → npm publish → milestone close)
+├── /homework                 → extract 찐빠, confirm gate (or --dry-run if requested)
+└── Check: any eligible issues remain?
+    ├── YES → next iteration
+    └── NO  → [FSD Done] converged naturally
+```
+
+## Safety and Discipline
+
+Each iteration operates under full project rules — no relaxation because FSD is autonomous:
+
+| Rule | Applies |
+|------|---------|
+| R001 (safety) | Destructive ops still require explicit approval. Credential guardrails always active. |
+| R009 (parallel) | Independent subtasks within each pipeline iteration run in parallel. |
+| R010 (orchestration) | All file modifications delegated to specialist subagents. mgr-gitnerd for git ops. |
+| R017 (sync verification) | mgr-sauron passes required before any commit. |
+| R020 (completion verification) | Each release verified via `npm view`, `gh release view`, closed issues before `[Done]`. |
+
+`/homework` runs as a **retrospective gate** between iterations — findings go through `omcustom-feedback`'s Phase 4A confirmation gate. The loop does NOT skip homework on the grounds that it is "automated". If homework requires user confirmation (e.g., to file a feedback issue), the loop pauses and waits.
+
+If a release operation triggers the safety classifier, the current iteration stops and surfaces the block to the user before continuing.
+
+## When to Use
+
+| Scenario | Use FSD? |
+|----------|----------|
+| Multiple eligible issues ready to process autonomously | YES |
+| Session where the user wants to "let it run" through the backlog | YES |
+| Verifying the autonomous release loop pattern from session memory | YES |
+| Single targeted issue fix | NO — use `/pipeline auto-dev` directly |
+| Exploratory research / planning only | NO — use `/research` or `/deep-plan` |
+| Only one issue and it needs human judgment | NO — use `/pipeline auto-dev` with manual oversight |
+
+## When NOT to Use
+
+- When issues require stakeholder approval or design decisions before implementation
+- When the issue set includes `decision-needed` or `needs-review` items only (loop converges immediately — just use `/pipeline auto-dev` once)
+- When cost sensitivity is high and the issue backlog is large — inspect the eligible set first before running FSD
+
+## Optional Release Cap
+
+Pass a numeric argument to cap at N releases:
+
+```
+/omcustom:fsd 3    # Process at most 3 issues this FSD run
+```
+
+This corresponds to the `-max` parameter used in the manual pattern. Default is unlimited (run until eligible issues exhausted). The cap is advisory — the pipeline itself may stop earlier if the eligible set runs out before the cap is reached.
+
+## Session 114 Precedent
+
+This skill was extracted from the manual pattern used in Session 114 (2026-06-09):
+
+```
+/goal "모든 이슈가 처리될 때까지" /loop "/pipeline auto-dev -> /homework"
+```
+
+That session ran 2 iterations (v0.177.0 and v0.178.0) before converging with 0 eligible issues remaining. FSD codifies this pattern as a first-class invocable command.
+
+## Cross-References
+
+| Skill / Rule | Role |
+|--------------|------|
+| `goal` | Disciplined goal-to-execution wrapper — objective parse, gap detection, R020 verification |
+| `omcustom-loop` | Session auto-continuation via SubagentStop hook — keeps the loop alive during background agent work |
+| `pipeline` | `/pipeline auto-dev` — the core release pipeline per iteration |
+| `homework` | Retrospective 찐빠 audit gate per iteration |
+| R001 (safety) | Destructive ops require approval; credential guardrails |
+| R009 (parallel execution) | Parallel subtasks within each pipeline iteration |
+| R010 (orchestrator coordination) | All file writes delegated; mgr-gitnerd for git |
+| R017 (sync verification) | mgr-sauron required before commit/push |
+| R020 (completion verification) | Actual outcome verified before declaring each release done |
+
+## Design Notes
+
+This skill is intentionally a **thin alias**. It does NOT duplicate:
+- Issue polling logic (owned by `pipeline`)
+- Loop cadence / auto-continuation (owned by `omcustom-loop` + SubagentStop hook)
+- Release pipeline steps (owned by `pipeline auto-dev`)
+- Retrospective analysis (owned by `homework`)
+- Completion verification (owned by R020 + `goal`)
+
+If any of those underlying skills evolve, FSD automatically benefits — its only responsibility is declaring the intent and forwarding to the right components.
+
+## Permission Mode Note
+
+When this skill delegates work via Agent tool calls, ALL Agent tool calls MUST include `mode: "bypassPermissions"` per R010 Universal bypassPermissions.
+
+## Artifact Output
+
+Artifacts from each iteration follow the conventions of the constituent skills:
+- Pipeline artifacts: `.claude/outputs/sessions/{YYYY-MM-DD}/pipeline-auto-dev-{HHmmss}.md`
+- Homework artifacts: `.claude/outputs/sessions/{YYYY-MM-DD}/homework-{HHmmss}.md`

package/templates/.claude/skills/homework/SKILL.md

@@ -168,6 +168,17 @@ If `--dry-run` is active, skip this phase and output the draft directly to the c
 └── 다음 액션: {harness 제안 있으면 표시, 없으면 "없음"}
 ```
 
+## Cross-Project Import Compatibility
+
+When `homework` is imported into a project OTHER than oh-my-customcode, its automatic `omcustom-feedback` invocation (the retrospective-filing phase) depends on `omcustom-feedback` being model-invocable in that project.
+
+| Condition | Behavior |
+|-----------|----------|
+| `omcustom-feedback` model-invocable (default in oh-my-customcode) | Auto-invoke files the retrospective normally |
+| `omcustom-feedback` has model invocation DISABLED (`disable-model-invocation`) in the importing project | Auto-invoke FAILS — fall back to MANUAL submission: present the drafted findings to the user and ask them to file the feedback (or run `omcustom-feedback` manually) |
+
+> Origin: #1336 — in the second-brain project, `omcustom-feedback` was model-invocation-disabled, so homework Phase 5's automatic invoke failed; the retrospective was filed manually. Document this dependency so cross-project imports degrade gracefully instead of silently failing the auto-file step.
+
 ## Options Reference
 
 | Option | Default | Description |

package/templates/CLAUDE.md

@@ -116,7 +116,7 @@ project/
 +-- CLAUDE.md                    # 진입점
 +-- .claude/
 |   +-- agents/                  # 서브에이전트 정의 (49 파일)
-|   +-- skills/                  # 스킬 (116 디렉토리)
+|   +-- skills/                  # 스킬 (117 디렉토리)
 |   +-- rules/                   # 전역 규칙 (R000-R023)
 |   +-- hooks/                   # 훅 스크립트 (보안, 검증, HUD)
 |   +-- contexts/                # 컨텍스트 파일 (ecomode)

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.178.0",
+  "version": "0.180.0",
   "lastUpdated": "2026-05-20T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",
@@ -20,7 +20,7 @@
       "name": "skills",
       "path": ".claude/skills",
       "description": "Reusable skill modules (includes slash commands)",
-      "files": 116
+      "files": 117
     },
     {
       "name": "guides",