oh-my-customcode 1.1.47 → 1.1.49

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.47",
+  "version": "1.1.49",
   "lastUpdated": "2026-07-14T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",
@@ -14,13 +14,13 @@
       "name": "agents",
       "path": ".claude/agents",
       "description": "AI agent definitions (flat .md files with prefixes)",
-      "files": 49
+      "files": 50
     },
     {
       "name": "skills",
       "path": ".claude/skills",
       "description": "Reusable skill modules (includes slash commands)",
-      "files": 114
+      "files": 115
     },
     {
       "name": "guides",

package/templates/workflows/auto-dev.yaml

@@ -5,6 +5,14 @@ version: "2.1.0"
 # Design rule: each pipeline run produces ONE bounded release unit (3-7 issues), not all open issues.
 # This pipeline is a project-agnostic template. Project-specific overrides belong in
 # the project's own workflows/auto-dev.yaml (e.g., AgentNav, second-brain).
+#
+# Design rule (R020 「위임 경계를 Phase 개수로 설계」 배선, Origin: #1595 #4):
+# 아래 `skill:` 스텝 중 다중 Phase 스킬(deep-plan = research→plan→verify, deep-verify = 다각 검증)은
+# 스킬을 그대로 spawn하지 않는다. Phase 경계가 곧 종료 유혹 지점이므로, 발주 전에 스킬의 Phase를
+# 읽고 **단일 목표 1개짜리 위임**으로 분할해 순차 발주한다. 실측(v1.1.48): `skill: deep-plan`을
+# 그대로 호출한 결과 tool_uses=0 / 6.9초 / 산출물 0으로 종료했고, 단일 목표 Plan 에이전트로
+# 재설계하니 1/1 완주했다. `skill:` 값은 **분할의 근거가 되는 스킬 정의**를 가리키는 것이지
+# "이 스킬을 1회 호출하라"는 뜻이 아니다.
 
 steps:
   - name: pre-triage
@@ -270,7 +278,7 @@ steps:
 
   - name: deep-plan
     skill: deep-plan
-    description: "Research-validated implementation plan (research → plan → verify) — skipped if docs-only, integrated-analysis allowed if lite"
+    description: "Research-validated implementation plan (research → plan → verify) — skipped if docs-only, integrated-analysis allowed if lite. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4)."
     depends_on: plan
 
   - name: implement
@@ -357,7 +365,7 @@ steps:
 
   - name: deep-verify
     skill: deep-verify
-    description: "Multi-angle release quality verification — self-review checklist if docs-only; mgr-sauron R017 + core self-check if lite"
+    description: "Multi-angle release quality verification — self-review checklist if docs-only; mgr-sauron R017 + core self-check if lite. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4)."
     depends_on: verify-build
 
   - name: release
@@ -398,8 +406,18 @@ steps:
            #   Edit ONLY the .version field — do NOT overwrite templates/manifest.json wholesale (e.g. a source-hash path→hash map).
            #   Recover a corrupted manifest: git show HEAD:templates/manifest.json | jq '.version="<NEW>"' > templates/manifest.json (#1423/#1154).
            d. templates/manifest.json: jq '.version = "<NEW>"' templates/manifest.json > templates/manifest.json.tmp && mv templates/manifest.json.tmp templates/manifest.json   [on release/v{NEW}]
-           e. bun run build — run standalone (NO pipe), read exit code directly ($? after a pipe is the last command's, R005/#1492).
-              This regenerates .omcustom.lock.json (generatorVersion/templateVersion) to <NEW> via scripts/sync-source-lockfile.ts.   [on release/v{NEW}]
+           e. ⚠ PREREQUISITE: steps c (package.json) AND d (templates/manifest.json) MUST BOTH be completed
+              before running this step. bun run build — run standalone (NO pipe), read exit code directly
+              ($? after a pipe is the last command's, R005/#1492).
+              Actual mechanism (corrected, #1593): `bun run build` invokes `scripts/sync-source-lockfile.ts`
+              (a 10-line wrapper with no version literals of its own), which calls
+              `generateAndWriteLockfileForDir` (`src/core/lockfile.ts`). That function reads versions via
+              `loadVersions()` (`src/core/sync.ts`) — `generatorVersion` FROM package.json, `templateVersion`
+              FROM templates/manifest.json — and writes both into .omcustom.lock.json. If step d has not yet
+              landed when this runs, the lockfile silently records the PREVIOUS templateVersion — no warning,
+              no error. Observed contamination: v1.1.47 shipped generatorVersion=1.1.47 / templateVersion=1.1.46
+              because the bump commit created package.json + lockfile together and manifest.json was bumped in
+              a later commit. Do NOT run this step until BOTH c and d are staged.   [on release/v{NEW}]
            f. git status --short — enumerate ALL tracked drift (`^ M`) the build produced; stage EVERY one (esp. .omcustom.lock.json) before commit.
               (#1531 — .omcustom.lock.json missed staging across 4 consecutive releases after v1.1.29; root cause was no build step between version bump and commit.)   [on release/v{NEW}]
            g. mgr-gitnerd commit: "chore(release): bump to v<NEW>" — MUST include the drift from step f.
@@ -411,12 +429,27 @@ steps:
            i. mandatory verification (with existence guard for partial-update safety), run on release/v{NEW}:
               [ -f scripts/verify-version-sync.sh ] && bash scripts/verify-version-sync.sh || echo "::warning::verify-version-sync.sh not found, version sync verification skipped"
               (verify-version-sync.sh 가 exit 1 시 release 단계 halt)
+           j. lockfile 3-way assertion (#1593 제안3, closes the gap step i's 2-way check misses) — run standalone
+              (NO pipe), read exit code directly, on release/v{NEW}:
+              jq -e --arg v "<NEW>" '.generatorVersion==$v and .templateVersion==$v' .omcustom.lock.json
+              실패 시 release 단계 halt — cause is almost always step e run before step d landed; fix by
+              re-running step d then step e, re-staging, and re-running this assertion.
 
          Version decision (semver) — PATCH-PREFERRED policy (post-1.0.0):
          - No existing tags → v0.1.0
          - Previous tag exists → DEFAULT to patch. When in doubt, patch — do NOT reflexively bump minor for rule/doc/skill edits.
            - patch (DEFAULT): rule/doc/skill/config/wiki/workflow changes, bugfixes, hardening, CC-compat notes — the vast majority of this project's changes
-           - minor: ONLY a genuinely NEW user-facing capability (a new skill/agent/command adding user-visible surface), not a refinement of an existing one
+           - minor: ONLY a new user-facing capability that changes HOW the harness is used — a new
+             workflow axis, a new command surface users must learn, or a contract other components
+             depend on. NOT "a file was added under .claude/skills/ or .claude/agents/".
+             ⚠ Counter-example (Origin: v1.1.49 세션, 사용자 지적): adding one skill + one agent
+             (agora: skills 114→115, agents 49→50) was initially scoped as v1.2.0 minor by reading
+             the old wording literally. That was WRONG — this repo adds skills routinely, and
+             skills reached 115 while the version stayed v1.1.48, so skill/agent addition is
+             ESTABLISHED as patch (target was corrected to v1.1.49). Count growth is this repo's
+             baseline rate of change, NOT a minor signal. If a version bump would follow
+             mechanically from "a new file exists", it is patch. Ask instead: does a user's
+             workflow change because of this?
            - major: breaking changes to user-facing contracts (CLI flags, public skill/command names, public API), or a deliberate milestone declaration (e.g., v1.0.0)
          - Previous tag is ahead of source version (e.g., tag v0.136.1, package.json 0.136.0): use next available skip-version (0.136.2)
 
@@ -428,7 +461,15 @@ steps:
            b. mgr-gitnerd creates PR: gh pr create --base develop --head release/v{NEW} --title "chore(release): bump to v{NEW}" --body "<MUST include 'Closes #N' for EVERY issue this release resolves>"
               ⚠ auto-tag.yml closes issues by grep'ing Closes/Fixes/Resolves keywords in the PR BODY — NOT by milestone membership NOR by commit message trailers. If the keywords are missing, no issues close and the workflow still reports success (#1531). Commit-message close keywords are explicitly forbidden during `implement` and step 1.g above (#1542) — the PR body is the ONLY place a close keyword should appear.
               Before creating the PR (whether via inline --body or --body-file), confirm the body text actually contains a Closes line per issue.
-           c. mgr-gitnerd merges PR (admin merge required due to branch protection)
+           c. mgr-gitnerd merges PR: gh pr merge {n} --merge --delete-branch (plain merge — NOT --admin).
+              Ground-truth (measured 2026-08-15, `gh api repos/{owner}/{repo}/branches/develop/protection`):
+              required status checks are exactly 6 — Test, Lint, Template Sync, Version Sync,
+              Dependency Security Audit, Rust Tests (strict=true); enforce_admins=false; NO
+              required_pull_request_reviews (no reviewer-approval requirement exists). v1.1.47 merged with a
+              plain `gh pr merge 1585 --merge --delete-branch` — no --admin needed. A plain merge succeeds
+              once all 6 checks report green. If the merge is rejected, do NOT reflexively add --admin —
+              re-run the protection query above to re-measure current requirements and report the actual
+              blocker (R010 bypass-flag pre-check: name what is bypassed and why before ever using --admin).
            d. DO NOT manually git tag or gh release create.
               auto-tag.yml fires on release/v* PR merge → creates tag → closes issues linked via PR-body Closes/Fixes/Resolves keywords → closes milestone → deletes release branch.
               release.yml fires on the tag → npm publish + GitHub Release creation.