oh-my-customcode 1.1.42 → 1.1.44

package/templates/.claude/rules/SHOULD-memory-integration.md

@@ -373,6 +373,16 @@ Session-end saves lose context: by the time the session ends, multiple discoveri
 Related records from session v0.87.2~v0.88.0 (issue #869). The originating memory files were later consolidated/removed; no live equivalents remain as of this writing.
 -->
 
+## Procedure-Summary Scope Tagging
+
+절차·순서를 메모리에 압축 요약할 때는 **적용 스코프를 함께 표기**한다. 압축은 문맥 경계를 가장 먼저 버리므로, 하위 단계 내부의 순서가 파이프라인 전체 순서로 읽히는 오독이 발생한다. 스코프 표기는 괄호 한 마디면 충분하다 — "(릴리즈 단계 내부 순서)", "(구현 커밋에는 미적용)"처럼 **무엇에 적용되지 않는지**까지 적으면 오독 여지가 사라진다.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| `release 브랜치 선생성 → 버전범프 → PR` (스코프 미표기 → 전체 파이프라인 순서로 오독) | `릴리즈 단계 내부 순서: release 브랜치 선생성 → 버전범프 → PR (구현 커밋은 develop 직행)` |
+
+Origin: #1563 찐빠 #5 — 위 요약이 릴리즈 단계 내부 순서인데 전체 파이프라인 순서로 오독되었다. Cross-reference: R013(Compact Output — 압축이 버리는 것을 인지), 위 Mid-Session Immediate Save(트리거 문맥 보존).
+
 ## Safety-Related Feedback Memory Framing
 
 > Origin: #1307 찐빠 #2 (Medium) — a sys-memory-keeper delegation prompt framed a learning as "오탐으로 판단하고 진행한다" (conclude it's a false positive and proceed), tripping the memory-poisoning safety classifier and requiring a rewrite.

package/templates/.claude/rules/SHOULD-verification-ladder.md

@@ -103,6 +103,16 @@ staleness/audit 검증은 model ID·placeholder·TBD뿐 아니라 **폐기된
 
 Origin: #1455 #1 (Session 127 회고 찐빠 #1) — cc-release-monitor PR #1449 머지 후 workflow_dispatch 실검증에서 issue_body의 `<details>`·릴리즈 요약에 12칸 리터럴 들여쓰기 발견 → PR #1451 재작업. 첫 위임이 문법 검증만 지시하고 샘플 값 출력 조립 검증을 누락. `textwrap.dedent` + 멀티라인 변수 함정이 문법 검증만으로는 미노출. R020(문법 통과 ≠ 출력 정상)과 정합.
 
+## Conditional-Output Verification — Positive/Negative Pair Mandate (Origin: #1563 #2)
+
+조건부로만 출력하는 대상(advisory 훅, 가드, 경고 emitter)의 동작을 검증하도록 위임할 때, 완료 기준은 **"출력이 나와야 하는 입력"과 "나오면 안 되는 입력"을 짝으로** 지정해야 한다. "stdout ≠ 0바이트" 같은 단일 프록시는 검증이 아니다 — 침묵이 정답인 입력에서도 통과를 요구하게 되어 기준 자체가 틀리고, 반대로 오탐(준수 턴에서 발화)을 통과시킨다.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| "지정 입력에서 stdout ≠ 0바이트"를 단일 완료 기준으로 위임 | 양성 케이스(발화해야 함)와 음성 케이스(침묵해야 함)를 짝으로 명시 |
+
+Origin: #1563 찐빠 #2 — R007/R008 advisor 발화 검증에 단일 "0바이트 아님" 프록시를 제시했으나, advisor는 준수 턴에서 침묵하는 것이 정상 동작이라 기준이 성립하지 않았다. Cross-reference: R020(Proxy Signal vs Canonical Ground-Truth — 프록시로 상태를 특성화하지 말 것), 위 Detection Guard Delegation Standard(positive-match vs negative-context 구분의 가드 설계 각도).
+
 ## Detection Guard Delegation Standard (Origin: #1438 #3)
 
 Tier-1 shift-left 검출 가드(예: deprecated-pattern grep 가드)의 설계·수정을 서브에이전트에 위임할 때, 위임 프롬프트는 **positive-match(genuine defect mandate — `MUST`/`MANDATORY` 인접 문맥)와 negative-context(deprecation note — "no longer"/"deprecated"/"불필요"/"폐기됨" 설명 문구)를 구분**하도록 명시해야 한다. 이를 누락하면 올바르게 수정된 파일의 폐기-설명 문구까지 과잉매칭하여 자기모순 BLOCK을 유발한다.
@@ -146,6 +156,8 @@ Before invoking a Workflow script, deterministically verify:
 | 프롬프트 문자열 내 셸 변수 `${...}`(`$?`, `${PIPESTATUS[0]}`, `$(...)` 등)가 `\${...}`로 이스케이프되어 있는지 사전 grep 확인 | JS 템플릿 리터럴 안의 이스케이프 안 된 셸 `${...}`를 JS가 JS 표현식으로 평가 → 런타임 `ReferenceError`(예: `PIPESTATUS is not defined`). `node --check`는 문법만 검사하여 이 런타임 오류를 못 잡으므로 별도 결정론 grep 검사가 필요함 |
 | Workflow `args`를 사용하는 스크립트가 `typeof args === 'string' ? JSON.parse(args) : args` 방어를 거친 뒤 필드에 접근하는지 확인 | 하니스가 객체 args를 문자열로 인코딩해 전달하면 `args.<field>`가 undefined가 되어 스크립트가 즉시 런타임 실패(0 agents 실행). `node --check`는 문법만 검사하므로 위 셸 `${...}` 이스케이프 항목과 동일한 런타임 계열을 잡지 못함 |
 
+> **v2.1.223+**: workflow script가 동적 `import()`로 workflow 샌드박스 **밖의 코드를 실행**할 수 있던 결함이 수정되었습니다. 위 표의 체크는 프롬프트 조립·문법·런타임 계열을 다루지만 **샌드박스 탈출은 다루지 않았고**, 구버전에서는 `node --check` 통과 + 프롬프트 정상 조립 상태에서도 스크립트가 경계 밖 코드를 끌어올 수 있었습니다. 외부에서 받은 workflow script를 실행하기 전 동적 `import()` 사용 여부를 grep으로 확인합니다(Tier-1 결정론 검사).
+
 #### Common Violation (#1271)
 Session 106 follow-up to #1266 ③: a Workflow authoring error recurred — the guardrail fact-sheet was concatenated onto the agent's RETURN VALUE instead of the prompt string, and a placeholder/assembly slip went uncaught because no pre-run sanity check existed. This check is the deterministic Tier-1 guard that catches such slips before the expensive run.
 

package/templates/.claude/skills/pipeline/workflows/auto-dev.yaml

@@ -82,6 +82,20 @@ steps:
          - If not existing:
            Create new milestone: gh api repos/{owner}/{repo}/milestones --method POST --field title="vX.Y.Z"
 
+      ⚠ This step is a 3-BRANCH STATE MACHINE (closed → HALT / open → reuse / absent → CREATE),
+        NOT a gate-only pre-check. The "absent → create" branch is a STATE CHANGE and is therefore
+        NEVER skipped by compression (see "Cross-tier — State-Change Side Effects Are NEVER
+        Compressed" in compression-mode-eval). Reading this as "just a milestone existence gate"
+        and skipping it under lite/docs-only leaves the release with no milestone (#1553 찐빠 #3).
+
+      3. Post-condition — MANDATORY re-query before proceeding:
+         gh api 'repos/{owner}/{repo}/milestones?state=all&per_page=100' --paginate \
+           --jq '.[] | select(.title == "vX.Y.Z") | "\(.number)|\(.state)"'
+         The milestone MUST exist and be open. If the re-query returns nothing, the create branch
+         did not take effect — HALT; do NOT proceed to Step 1 on an unverified milestone.
+         `--paginate` is REQUIRED: with 100+ milestones in the repo a single page silently drops
+         the newest entries, so a just-created milestone can read back as absent.
+
       ## Step 1 — Label-based filtering (G4)
 
       Reference label semantics: .claude/skills/pipeline/labels.md
@@ -131,6 +145,9 @@ steps:
         - deep-plan step: skip deep-plan skill; single-response implementation notes instead
         - deep-verify step: skip deep-verify skill; perform self-review checklist instead
         - Log: "[compression-mode] docs-only compression activated (scope={n}, all docs/yaml labels)"
+        - ⚠ Analysis artifacts only. Every step's state-change side effect (milestone create/assign,
+          label add/remove, issue assign/comment/close) still runs in full — see "Cross-tier —
+          State-Change Side Effects Are NEVER Compressed" below.
 
       ## Tier 2 — lite (intermediate)
 
@@ -158,6 +175,9 @@ steps:
           "[compression-mode] lite — skill 단계 통합 분석 대체. 정당화: scope={n}, 모든 이슈 저위험(라벨 {labels}), 구현 대상 이슈 본문 명시 {issue_refs}"
         - If the justification cannot be stated concretely (e.g., a stage cannot be safely integrated),
           do NOT compress that stage — fall back to full skill spawn for it.
+        - ⚠ "통합 분석 대체" replaces analysis output ONLY. Every step's state-change side effect
+          (milestone create/assign, label add/remove, issue assign/comment/close) still runs in full
+          — see "Cross-tier — State-Change Side Effects Are NEVER Compressed" below.
 
       ## Tier 3 — standard (fallback)
 
@@ -165,6 +185,42 @@ steps:
         - All pipeline steps execute normally with full skill spawns
         - Log: "[compression-mode] standard mode (scope={n}, mixed/high-risk labels, large scope, or code logic change)"
 
+      ## Cross-tier — State-Change Side Effects Are NEVER Compressed
+
+      Compression (docs-only / lite) substitutes ANALYSIS ARTIFACTS ONLY. A step's
+      STATE-CHANGE SIDE EFFECTS — milestone create/assign, label add/remove, issue
+      assign, issue comment, issue/milestone close — are NOT analysis output and MUST
+      be performed regardless of compression mode. "통합 분석 대체" replaces how the
+      step THINKS, never what the step CHANGES.
+
+      A step is not a monolith: "skip the professor-triage skill spawn" does NOT
+      authorize skipping that step's gh state mutations. Before compressing any step,
+      consult the inventory below and execute every side effect it lists.
+
+      ### Step side-effect inventory (state changes; MUST run in every compression mode)
+
+      | Step | State-change side effects (MANDATORY regardless of compression_mode) |
+      |------|---------------------------------------------------------------------|
+      | pre-triage | `gh label create in-progress / verify-ready / needs-review --force` (idempotent label bootstrap) |
+      | scope-selection | Milestone 3-branch state machine (Step 0): closed → HALT / open → reuse / absent → `gh api repos/{owner}/{repo}/milestones --method POST`. Then: assign every scoped issue to that milestone. |
+      | compression-mode-eval | none (pure evaluation + justification logs) |
+      | triage | none (analysis only) — compressible |
+      | plan | none (analysis only) — compressible |
+      | deep-plan | none (analysis only) — compressible |
+      | implement | `gh issue edit <N> --add-label in-progress --assignee @me`; `gh issue comment <N>` (start notice); on success remove in-progress + add verify-ready; on failure remove in-progress + add needs-review + comment error summary |
+      | verify-build | none (gate only) |
+      | deep-verify | none (analysis only) — compressible |
+      | release | PR body MUST carry `Closes #N` for every resolved issue (auto-tag.yml greps the PR body); non-auto-tag projects additionally: `gh api .../milestones/{n} --method PATCH --field state=closed`, `gh issue close {n}`, label needs-review issues "Deferred from v{version}" |
+      | ci-check | none (verification only) |
+      | post-release-followup | new issue registration for release follow-ups (genuine defects auto-registered, no-ask per R016) |
+
+      Only the rows marked "none (analysis only)" are compressible. Any step with a
+      non-empty side-effect cell executes those effects in FULL under docs-only and lite.
+
+      Origin: #1553 찐빠 #3 — v1.1.41 릴리즈에서 lite 압축이 scope-selection의
+      "마일스톤 미존재 → 생성" 분기까지 함께 생략해 마일스톤이 만들어지지 않았다.
+      압축 대상은 분석 산출물이었으나 상태 변경 분기가 동반 생략됐다.
+
       ## Cross-tier — Pre-Existing Converged Artifact Substitution
 
       Independent of the tier selected above, an INDIVIDUAL planning/verification step (triage / plan / deep-plan / deep-verify) MAY be satisfied by a pre-existing converged artifact instead of a fresh skill spawn — even in standard mode — when ALL of the following hold for that step:

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.42",
+  "version": "1.1.44",
   "lastUpdated": "2026-07-14T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",

package/templates/workflows/auto-dev.yaml

@@ -82,6 +82,20 @@ steps:
          - If not existing:
            Create new milestone: gh api repos/{owner}/{repo}/milestones --method POST --field title="vX.Y.Z"
 
+      ⚠ This step is a 3-BRANCH STATE MACHINE (closed → HALT / open → reuse / absent → CREATE),
+        NOT a gate-only pre-check. The "absent → create" branch is a STATE CHANGE and is therefore
+        NEVER skipped by compression (see "Cross-tier — State-Change Side Effects Are NEVER
+        Compressed" in compression-mode-eval). Reading this as "just a milestone existence gate"
+        and skipping it under lite/docs-only leaves the release with no milestone (#1553 찐빠 #3).
+
+      3. Post-condition — MANDATORY re-query before proceeding:
+         gh api 'repos/{owner}/{repo}/milestones?state=all&per_page=100' --paginate \
+           --jq '.[] | select(.title == "vX.Y.Z") | "\(.number)|\(.state)"'
+         The milestone MUST exist and be open. If the re-query returns nothing, the create branch
+         did not take effect — HALT; do NOT proceed to Step 1 on an unverified milestone.
+         `--paginate` is REQUIRED: with 100+ milestones in the repo a single page silently drops
+         the newest entries, so a just-created milestone can read back as absent.
+
       ## Step 1 — Label-based filtering (G4)
 
       Reference label semantics: .claude/skills/pipeline/labels.md
@@ -131,6 +145,9 @@ steps:
         - deep-plan step: skip deep-plan skill; single-response implementation notes instead
         - deep-verify step: skip deep-verify skill; perform self-review checklist instead
         - Log: "[compression-mode] docs-only compression activated (scope={n}, all docs/yaml labels)"
+        - ⚠ Analysis artifacts only. Every step's state-change side effect (milestone create/assign,
+          label add/remove, issue assign/comment/close) still runs in full — see "Cross-tier —
+          State-Change Side Effects Are NEVER Compressed" below.
 
       ## Tier 2 — lite (intermediate)
 
@@ -158,6 +175,9 @@ steps:
           "[compression-mode] lite — skill 단계 통합 분석 대체. 정당화: scope={n}, 모든 이슈 저위험(라벨 {labels}), 구현 대상 이슈 본문 명시 {issue_refs}"
         - If the justification cannot be stated concretely (e.g., a stage cannot be safely integrated),
           do NOT compress that stage — fall back to full skill spawn for it.
+        - ⚠ "통합 분석 대체" replaces analysis output ONLY. Every step's state-change side effect
+          (milestone create/assign, label add/remove, issue assign/comment/close) still runs in full
+          — see "Cross-tier — State-Change Side Effects Are NEVER Compressed" below.
 
       ## Tier 3 — standard (fallback)
 
@@ -165,6 +185,42 @@ steps:
         - All pipeline steps execute normally with full skill spawns
         - Log: "[compression-mode] standard mode (scope={n}, mixed/high-risk labels, large scope, or code logic change)"
 
+      ## Cross-tier — State-Change Side Effects Are NEVER Compressed
+
+      Compression (docs-only / lite) substitutes ANALYSIS ARTIFACTS ONLY. A step's
+      STATE-CHANGE SIDE EFFECTS — milestone create/assign, label add/remove, issue
+      assign, issue comment, issue/milestone close — are NOT analysis output and MUST
+      be performed regardless of compression mode. "통합 분석 대체" replaces how the
+      step THINKS, never what the step CHANGES.
+
+      A step is not a monolith: "skip the professor-triage skill spawn" does NOT
+      authorize skipping that step's gh state mutations. Before compressing any step,
+      consult the inventory below and execute every side effect it lists.
+
+      ### Step side-effect inventory (state changes; MUST run in every compression mode)
+
+      | Step | State-change side effects (MANDATORY regardless of compression_mode) |
+      |------|---------------------------------------------------------------------|
+      | pre-triage | `gh label create in-progress / verify-ready / needs-review --force` (idempotent label bootstrap) |
+      | scope-selection | Milestone 3-branch state machine (Step 0): closed → HALT / open → reuse / absent → `gh api repos/{owner}/{repo}/milestones --method POST`. Then: assign every scoped issue to that milestone. |
+      | compression-mode-eval | none (pure evaluation + justification logs) |
+      | triage | none (analysis only) — compressible |
+      | plan | none (analysis only) — compressible |
+      | deep-plan | none (analysis only) — compressible |
+      | implement | `gh issue edit <N> --add-label in-progress --assignee @me`; `gh issue comment <N>` (start notice); on success remove in-progress + add verify-ready; on failure remove in-progress + add needs-review + comment error summary |
+      | verify-build | none (gate only) |
+      | deep-verify | none (analysis only) — compressible |
+      | release | PR body MUST carry `Closes #N` for every resolved issue (auto-tag.yml greps the PR body); non-auto-tag projects additionally: `gh api .../milestones/{n} --method PATCH --field state=closed`, `gh issue close {n}`, label needs-review issues "Deferred from v{version}" |
+      | ci-check | none (verification only) |
+      | post-release-followup | new issue registration for release follow-ups (genuine defects auto-registered, no-ask per R016) |
+
+      Only the rows marked "none (analysis only)" are compressible. Any step with a
+      non-empty side-effect cell executes those effects in FULL under docs-only and lite.
+
+      Origin: #1553 찐빠 #3 — v1.1.41 릴리즈에서 lite 압축이 scope-selection의
+      "마일스톤 미존재 → 생성" 분기까지 함께 생략해 마일스톤이 만들어지지 않았다.
+      압축 대상은 분석 산출물이었으나 상태 변경 분기가 동반 생략됐다.
+
       ## Cross-tier — Pre-Existing Converged Artifact Substitution
 
       Independent of the tier selected above, an INDIVIDUAL planning/verification step (triage / plan / deep-plan / deep-verify) MAY be satisfied by a pre-existing converged artifact instead of a fresh skill spawn — even in standard mode — when ALL of the following hold for that step: