oh-my-opencode 5.0.0-beta.9 → 5.0.0-beta.90

package/packages/omo-codex/plugin/scripts/sync-skills.mjs

@@ -3,15 +3,28 @@ import { cp, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { resolveCanonicalUltraworkDirectivePath } from "./canonical-ultrawork-directive.mjs";
 import { isCliEntry } from "./entry-guard.mjs";
 import { sharedSkillsRootPath } from "@oh-my-opencode/shared-skills";
+import { createSkillSourceCopyFilter } from "@oh-my-opencode/shared-skills/skill-source-filter";
 
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const repoRoot = join(root, "..", "..", "..");
 const sharedSkillsRoot = sharedSkillsRootPath();
 const skillsRoot = join(root, "skills");
-const sourceTestFilePattern = /\.test\.ts$/;
-const ignoredSkillSourceDirNames = new Set([".mypy_cache", ".omo", ".pytest_cache", ".ruff_cache", "__pycache__"]);
-const ignoredSkillSourceFileNames = new Set([".gitignore", ".npmignore", "pyrightconfig.json"]);
+// The ultrawork skill body is the canonical prompts-core directive, read DIRECTLY here rather than
+// from a component-local copy: sync-skills runs before build-components (see plugin/package.json
+// build chain), so consuming components/ultrawork/scripts/sync-directive.mjs output would break a
+// clean checkout.
+const canonicalUltraworkDirectivePath = resolveCanonicalUltraworkDirectivePath(root, repoRoot);
+const ultraworkSkillFrontmatter = `---
+name: ultrawork
+description: Binding ultrawork mode directive for omo on Codex. When a prompt contains ultrawork or ulw, the omo UserPromptSubmit hook injects a short bootstrap that points at this file. Read the whole file and follow every rule in it for the rest of the task.
+metadata:
+  short-description: Binding ultrawork mode directive
+---
+
+`;
 const skillSources = [
 	["comment-checker", "components/comment-checker/skills/comment-checker"],
 	["lcx-contribute-bug-fix", "components/lcx/skills/lcx-contribute-bug-fix"],
@@ -22,22 +35,10 @@ const skillSources = [
 	["teammode", "components/teammode/skills/teammode"],
 	["ulw-loop", "components/ulw-loop/skills/ulw-loop"],
 	["ulw-plan", "components/ultrawork/skills/ulw-plan"],
-	["ultrawork", "components/ultrawork/skills/ultrawork"],
 ];
-const componentSkillNames = new Set(skillSources.map(([name]) => name));
+const componentSkillNames = new Set([...skillSources.map(([name]) => name), "ultrawork"]);
 const skillDisplayPrefix = "(OmO) ";
 
-function shouldCopySkillSource(source) {
-	const normalized = source.replaceAll("\\", "/");
-	const segments = normalized.split("/");
-	const name = segments.at(-1) ?? "";
-	if (segments.some((segment) => ignoredSkillSourceDirNames.has(segment))) return false;
-	if (ignoredSkillSourceFileNames.has(name)) return false;
-	if (sourceTestFilePattern.test(name) || name.endsWith(".pyc")) return false;
-	const scriptsIndex = segments.lastIndexOf("scripts");
-	return scriptsIndex === -1 || segments[scriptsIndex + 1] !== "tests";
-}
-
 const opencodeOnlyOrchestrationPattern = /\b(?:call_omo_agent|background_output|team_[a-z_]+|task)\s*\(/;
 
 export const codexHarnessToolCompatibility = `## Codex Harness Tool Compatibility
@@ -49,22 +50,26 @@ This skill may include examples copied from the OpenCode harness. In Codex, do n
 | \`call_omo_agent(subagent_type="explore", ...)\` | \`multi_agent_v1.spawn_agent({"message":"TASK: act as an explorer. ...","agent_type":"explorer","fork_context":false})\` |
 | \`call_omo_agent(subagent_type="librarian", ...)\` | \`multi_agent_v1.spawn_agent({"message":"TASK: act as a librarian. ...","agent_type":"librarian","fork_context":false})\` |
 | \`task(subagent_type="plan", ...)\` | \`multi_agent_v1.spawn_agent({"message":"TASK: act as a planning agent. ...","agent_type":"plan","fork_context":false})\` |
-| \`task(subagent_type="oracle", ...)\` for final verification | \`multi_agent_v1.spawn_agent({"message":"TASK: act as a rigorous reviewer. ...","agent_type":"lazycodex-gate-reviewer","fork_context":false})\` |
-| \`task(category="...", ...)\` for implementation or QA | \`multi_agent_v1.spawn_agent({"message":"TASK: act as an implementation or QA worker. ...","fork_context":false})\` |
+| \`task(subagent_type="oracle", ...)\` for final verification | By default, record a self-review in the notepad: re-read the diff, run diagnostics, and capture evidence for every acceptance criterion. Only when the user demanded strict, rigorous, or high-accuracy review, use \`multi_agent_v1.spawn_agent({"message":"TASK: act as a rigorous reviewer. ...","agent_type":"lazycodex-gate-reviewer","fork_context":false})\`; include \`fork_context: false\`. |
+| \`task(category="...", ...)\` for implementation or QA | \`multi_agent_v1.spawn_agent({"message":"TASK: act as an implementation or QA worker. ...","agent_type":"lazycodex-worker-medium","fork_context":false})\` |
 | \`background_output(task_id="...")\` | \`multi_agent_v1.wait_agent(...)\` for mailbox signals |
 | \`team_*(...)\` | Use Codex native subagents via \`multi_agent_v1.spawn_agent\` and \`multi_agent_v1.wait_agent\`; use \`multi_agent_v1.send_input\` and \`multi_agent_v1.close_agent\` only when exposed in the active tools list |
 
-Role-specific behavior must be described in a self-contained \`message\`. Use \`fork_context: false\` to start the child with only the initial prompt (no parent history); use \`fork_context: true\` only when full parent history is truly required. Include any required conversation context, files, diffs, constraints, and requested skill names directly in the spawned agent's \`message\`. OMO installs these selectable agent roles into \`~/.codex/agents/\`: \`explorer\`, \`librarian\`, \`plan\`, \`momus\`, \`metis\`, \`lazycodex-code-reviewer\`, \`lazycodex-qa-executor\`, and \`lazycodex-gate-reviewer\` - pass the matching name as \`agent_type\` so the child gets that role's model and instructions. If the spawn tool exposes no \`agent_type\` parameter, omit it and describe the role inside \`message\`. If a code block below conflicts with this section, this section wins.
+Role-specific behavior must be described in a self-contained \`message\`. Use \`fork_context: false\` to start the child with only the initial prompt (no parent history); use \`fork_context: true\` only when full parent history is truly required. Include any required conversation context, files, diffs, constraints, and requested skill names directly in the spawned agent's \`message\`. OMO installs these selectable agent roles into \`~/.codex/agents/\`: \`explorer\`, \`librarian\`, \`plan\`, \`momus\`, \`metis\`, \`lazycodex-code-reviewer\`, \`lazycodex-qa-executor\`, and \`lazycodex-gate-reviewer\` - pass the matching name as \`agent_type\` so the child gets that role's model and instructions. Inspect the actual spawn schema: whenever \`agent_type\` is exposed, EVERY spawn MUST select an exact LazyCodex role, on V1 or V2. Implementation difficulty selects \`lazycodex-worker-low\`, \`lazycodex-worker-medium\`, or \`lazycodex-worker-high\`; clone QA can select \`lazycodex-clone-fidelity-reviewer\`. Never select generic \`worker\` or \`default\`. If a code block below conflicts with this section, this section wins.
 
-Codex exposes ONE of two subagent tool surfaces per session; check your own tool list and route accordingly. If \`multi_agent_v1.*\` tools exist, use the table above as written. If instead a flat \`spawn_agent\` with a required \`task_name\` exists (\`multi_agent_v2\`), rewrite every \`multi_agent_v1.*\` example: \`multi_agent_v1.spawn_agent({...,"fork_context":false})\` becomes \`spawn_agent({"task_name":"<lowercase_digits_underscores>","message":...,"agent_type":...,"fork_turns":"none"})\` (\`"all"\` only when full parent history is truly required); \`send_input\` becomes \`send_message\`; do not call \`close_agent\`/\`resume_agent\` (finished agents end on their own; \`followup_task\` re-tasks one, \`interrupt_agent\` stops one); \`wait_agent\` takes only \`timeout_ms\` and returns on any child mailbox activity. On the v2 surface \`agent_type\` may be ABSENT from the spawn schema (verified 2026-07-11: only \`fork_turns\`/\`message\`/\`task_name\`) — when absent, omit it and describe the role inside \`message\`; installed role TOMLs cannot be selected on that surface. If a code block below conflicts with this section, this section wins.
+Codex exposes ONE of two subagent tool surfaces per session; check your own tool list and route accordingly. If \`multi_agent_v1.*\` tools exist, use the table above as written. If instead a flat \`spawn_agent\` with a required \`task_name\` exists (\`multi_agent_v2\`), rewrite every \`multi_agent_v1.*\` example: \`multi_agent_v1.spawn_agent({...,"fork_context":false})\` becomes \`spawn_agent({"task_name":"<lowercase_digits_underscores>","message":...,"agent_type":...,"fork_turns":"none"})\` (\`"all"\` only when full parent history is truly required); \`send_input\` becomes \`send_message\`; do not call \`close_agent\`/\`resume_agent\` (finished agents end on their own; \`followup_task\` re-tasks one, \`interrupt_agent\` stops one); \`wait_agent\` takes only \`timeout_ms\` and returns on any child mailbox activity. Do not infer role support from V1/V2 or a model version. Legacy-schema exception: only if the actual schema lacks \`agent_type\`, omit that unsupported field and carry the complete role instructions in \`message\`, with history explicitly disabled. This cannot select a specialized TOML; an installed managed default supplies the medium worker for unnamed non-forks. The guard has no schema metadata and rejects unnamed calls, so report incompatible routing instead of retrying generically. Every deliberate full-history fork must still name its role: Codex skips role application on unnamed full-history forks, an upstream gap no LazyCodex default can repair. If a code block below conflicts with this section, this section wins. \`fork_context\` is rejected on \`multi_agent_v2\` (\`fork_context is not supported in MultiAgentV2; use fork_turns instead\`).
 
 When translating \`load_skills=[...]\`, include the requested skill names in the spawned agent's \`message\`. If a code block below conflicts with this section, this section wins.
 
+Omit optional keys you do not set. Never send \`items: []\`, \`message: ""\`, \`model: ""\`, \`reasoning_effort: ""\`, or \`service_tier: ""\` — Codex rejects them (\`Items can't be empty\`, \`reasoning_effort must not be empty\`).
+
 For work likely to exceed one wait cycle, require the child to send \`WORKING: <task> - <current phase>\` before long passes and \`BLOCKED: <reason>\` only when progress stops. A \`multi_agent_v1.wait_agent\` timeout only means no new mailbox update arrived; back off between waits (double the timeout up to ~5 minutes) instead of spinning short cycles. Treat a running child as alive. Fallback only when the child is completed without the deliverable, ack-only after followup, explicitly \`BLOCKED:\`, or no longer running.
 
 `;
 
 const codexCompatibilityEndMarkers = [
+	"Omit optional keys you do not set. Never send `items: []`, `message: \"\"`, `model: \"\"`, `reasoning_effort: \"\"`, or `service_tier: \"\"` — Codex rejects them (`Items can't be empty`, `reasoning_effort must not be empty`).\n\nFor work likely to exceed one wait cycle, require the child to send `WORKING: <task> - <current phase>` before long passes and `BLOCKED: <reason>` only when progress stops. A `multi_agent_v1.wait_agent` timeout only means no new mailbox update arrived; back off between waits (double the timeout up to ~5 minutes) instead of spinning short cycles. Treat a running child as alive. Fallback only when the child is completed without the deliverable, ack-only after followup, explicitly `BLOCKED:`, or no longer running.\n\n",
+	"On the v2 surface `agent_type` may be ABSENT from the spawn schema (verified 2026-07-11: only `fork_turns`/`message`/`task_name`) — when absent, omit it and describe the role inside `message`; installed role TOMLs cannot be selected on that surface. If a code block below conflicts with this section, this section wins. `fork_context` is rejected on `multi_agent_v2` (`fork_context is not supported in MultiAgentV2; use fork_turns instead`).\n\n",
 	"For work likely to exceed one wait cycle, require the child to send `WORKING: <task> - <current phase>` before long passes and `BLOCKED: <reason>` only when progress stops. A `multi_agent_v1.wait_agent` timeout only means no new mailbox update arrived. Treat a running child as alive. Fallback only when the child is completed without the deliverable, ack-only after followup, explicitly `BLOCKED:`, or no longer running.\n\n",
 	"On `multi_agent_v2` sessions the same `agent_type` applies (the OMO installer exposes it) with `fork_turns` instead of `fork_context`. If a code block below conflicts with this section, this section wins.\n\n",
 	"Role-specific behavior must be described in a self-contained `message`. Use `fork_context: false` to start the child with only the initial prompt (no parent history); use `fork_context: true` only when full parent history is truly required. Include any required conversation context, files, diffs, constraints, and requested skill names directly in the spawned agent's `message`. If a code block below conflicts with this section, this section wins.\n\n",
@@ -102,8 +107,8 @@ function hasKnownGeneratedCodexCompatibilityGuidance(content, compatibilityIndex
 	return codexCompatibilityEndMarkers.some((marker) => content.indexOf(marker, compatibilityIndex) !== -1);
 }
 
-export function insertCodexCompatibilityGuidance(content) {
-	if (!opencodeOnlyOrchestrationPattern.test(content)) return content;
+export function insertCodexCompatibilityGuidance(content, force = false) {
+	if (!force && !opencodeOnlyOrchestrationPattern.test(content)) return content;
 	const firstExampleIndex = content.search(opencodeOnlyOrchestrationPattern);
 	const compatibilityIndex = content.indexOf("## Codex Harness Tool Compatibility");
 	if (
@@ -124,36 +129,19 @@ export function insertCodexCompatibilityGuidance(content) {
 	return `${frontmatterMatch[0]}${codexHarnessToolCompatibility}${contentWithoutGuidance.slice(frontmatterMatch[0].length)}`;
 }
 
-const startWorkOriginalCompletion = `When all top-level checkboxes in \`## TODOs\` and \`## Final Verification Wave\` are complete:
-
-1. Run the plan's final verification commands.
-2. For PR/branch work, finish the lifecycle from the task-owned worktree: sync \`.omo/\` state back to the main repo, create or update the PR, wait for review/verification gates, merge by default unless explicitly opted out, and remove the worktree only after successful merge or explicit handoff.
-3. Remove or mark the Boulder work as completed.
-4. Print an \`ORCHESTRATION COMPLETE\` block with the plan path, verification commands, artifacts, and cleanup receipts.`;
-
-const startWorkCodexCompletion = `When all top-level checkboxes in \`## TODOs\` and \`## Final Verification Wave\` are complete:
-
-1. Run the plan's final verification commands.
-2. Complete the **Global Review and Debugging Gate** before any completion claim, PR creation, PR handoff, branch handoff, or merge:
-   - Invoke the \`review-work\` skill with the final diff, changed files, user goal, constraints, run command, and verification evidence. All five review lanes must return PASS. A timeout, missing deliverable, ack-only child, \`BLOCKED:\`, or inconclusive lane is a gate failure, not approval.
-   - Each passing review lane binds to the exact full commit SHA it reviewed. Immediately append a durable record to \`.omo/start-work/ledger.jsonl\` with the lane name, full SHA, PASS verdict, and report artifact/source. Before same-SHA reuse after any continuation or compaction, re-read the ledger record and require the exact lane/SHA pair; memory, chat history, or an unstamped report is not coverage. New commits require fresh applicable lane coverage.
-   - Run a debugging-oriented runtime audit even when the review passes: name at least three plausible failure hypotheses for the changed surface, run the distinguishing checks against the actual artifact, and append a separate durable record with the audit name, exact full SHA, verdict, and evidence artifact/source to \`.omo/start-work/ledger.jsonl\`. Reuse it only after re-reading an exact audit/SHA match.
-   - If any review lane or debugging hypothesis fails, invoke the \`debugging\` skill, confirm root cause with runtime evidence, add the minimal failing test or reproduction, fix it, rerun the affected verification, then rerun the Global Review and Debugging Gate.
-   - Evidence hygiene is mandatory: redact or mask secrets and sensitive user data before writing \`.omo/start-work/ledger.jsonl\`, a PR body, or a handoff. Never include raw tokens, credentials, auth headers, cookies, API keys, env dumps, private logs, or PII; use concise summaries, lengths, hashes, or short non-sensitive prefixes instead.
-   - If the work includes creating, updating, or handing off a PR, refresh \`git status\` and the PR/branch state from the task-owned worktree after the gate, and include only redacted review/debugging evidence in the PR body or handoff.
-3. Finish the PR/branch lifecycle from its task-owned worktree: sync \`.omo/\` state back to the main repo, create or update the PR when requested, wait for CI/review/Cubic gates, merge by default unless explicitly opted out, and remove the worktree only after successful merge or explicit handoff.
-4. Remove or mark the Boulder work as completed.
-5. Print an \`ORCHESTRATION COMPLETE\` block with the plan path, verification commands, Global Review and Debugging Gate verdict, artifacts, and cleanup receipts.`;
-
-const startWorkOriginalHardRule = "- No completion claim while an applicable ultraqa adversarial class was never probed. Each applicable class needs a captured observable result; each skipped class needs a one-line not-applicable reason in the ledger.\n- No PR/branch implementation, review, or merge in the main worktree; use the task-owned git worktree.\n- No unprefixed session ids in Boulder state. Sessions are always recorded as `codex:<session_id>`.";
-
-const startWorkCodexHardRule = "- No completion claim while an applicable ultraqa adversarial class was never probed. Each applicable class needs a captured observable result; each skipped class needs a one-line not-applicable reason in the ledger.\n- No `ORCHESTRATION COMPLETE`, final response, PR creation, PR handoff, or merge before the Global Review and Debugging Gate passes with recorded evidence.\n- No PR/branch implementation or review in the main worktree; create or use a task-owned git worktree first.\n- No unprefixed session ids in Boulder state. Sessions are always recorded as `codex:<session_id>`.";
-
-const reviewWorkAnchor = "Launch 5 specialized sub-agents in parallel to review completed implementation work from every angle. All 5 must pass for the review to pass. If even ONE fails, the review fails.\n";
+export const reviewWorkAnchor = "Review completed implementation work through exactly two lanes: your own hands-on manual QA on the real surface, and ONE gate reviewer sub-agent that audits the whole change set against the goal, the constraints, and your QA evidence. The review passes only when the QA matrix has no failing row AND the gate reviewer returns APPROVE.\n";
 
 const reviewWorkCodexGate = `
-When \`review-work\` is used as a final implementation, PR, or \`$start-work\`
-gate, it is blocking. A timeout, missing deliverable, ack-only response,
+On Codex, use \`review-work\` only when the user asks for a review or demands
+strict, rigorous, or high-accuracy verification, not automatically for a PR or
+completion claim. Your own manual QA and the main session's self-review are
+the default. Spawn ONE \`lazycodex-gate-reviewer\` only for an explicit demand
+for strict review; otherwise run the review checklist inline and record the
+main session's verdict instead of spawning or waiting for a reviewer. These
+Codex rules override the mandatory-reviewer instructions in the shared skill.
+
+When \`review-work\` is used as a final implementation, PR, or \`$ulw-execute\`
+gate, the selected review is blocking. A timeout, missing deliverable, ack-only response,
 explicit \`BLOCKED:\`, or inconclusive lane is not a pass. Treat that lane as
 failed, investigate the underlying uncertainty with the \`debugging\` skill when
 runtime behavior may be wrong, fix with evidence, and rerun the affected lane
@@ -183,17 +171,57 @@ private logs, or PII; summarize with lengths, hashes, and short non-sensitive
 prefixes when identity is needed.
 `;
 
-const ulwResearchOriginalDeliveryGates = "### The delivery gates \u2014 every gate must PASS, in order\n\nNothing reaches the user until the gates pass:\n\n1. **Visual QA (always).** Render the produced artifact back to images \u2014 PDF pages to PNG, the HTML in a real browser \u2014 and look at them: missing or broken figures, images stretched or spilling their containers, diagram or chart text rendered off the spec's font or palette, clipped tables, overflowing CJK text, blank pages, unlabeled chart values, wrong page breaks. Fix and re-render until the pages are clean. Reading the source markup is not visual QA; inspect the pixels.\n2. **Proofread gate \u2014 `task(category=\"writing\", ...)`.** Hand the final text to a dedicated `writing` worker whose only job is language: grammar, spelling, punctuation, terminology consistency, and whether the prose reads NATIVELY in the report's own language. It returns a defect list; fix every item and re-run the gate on the delta. Deliver only on a clean pass \u2014 this gate runs BEFORE the first delivery, not after the user finds the typo.";
-const ulwResearchCodexDeliveryGate = "### The delivery gate \u2014 visual QA must PASS\n\nNothing reaches the user until the gate passes:\n\n**Visual QA (always).** Render the produced artifact back to images \u2014 PDF pages to PNG, the HTML in a real browser \u2014 and look at them: missing or broken figures, images stretched or spilling their containers, diagram or chart text rendered off the spec's font or palette, clipped tables, overflowing CJK text, blank pages, unlabeled chart values, wrong page breaks. Fix and re-render until the pages are clean. Reading the source markup is not visual QA; inspect the pixels.";
-
-function applyCodexSkillOverlays(skillName, content) {
+const ulwResearchOriginalDeliveryGates = "Reading the source markup is not visual QA; inspect the pixels.\n4. **Proofread gate \u2014 `task(category=\"writing\", ...)`.** Hand the final text to a dedicated `writing` worker whose only job is language: grammar, spelling, punctuation, terminology consistency, and whether the prose reads NATIVELY in the report's own language. It proofreads only and never composes. It returns a defect list; fix every item and re-run the gate on the delta. Deliver only on a clean pass \u2014 this gate runs BEFORE the first delivery, not after the user finds the typo.";
+const ulwResearchCodexDeliveryGate = "Reading the source markup is not visual QA; inspect the pixels.";
+
+export const ulwExecuteOriginalCompletion = [
+	"When all top-level checkboxes in `## TODOs` and `## Final Verification Wave` are complete:",
+	"",
+	"1. Run the plan's final verification commands.",
+	"2. For PR/branch work, finish the lifecycle from the last phase's worktree: sync `.omo/` state back to the main repo, create or update the PR, wait for review/verification gates, merge by default unless explicitly opted out, and remove the worktree only after successful merge or explicit handoff.",
+	"3. Remove or mark the Boulder work as completed.",
+	"4. Print an `ORCHESTRATION COMPLETE` block with the plan path, verification commands, artifacts, and cleanup receipts.",
+].join("\n");
+export const ulwExecuteOriginalHardRule = [
+	"- No production change before the tests covering that behavior were read and a bug's reproduction captured; existing tests are green on the unchanged code first, and one that contradicts the intent is a FINDING, never edited green.",
+	"- No `--dry-run` as completion evidence.",
+	"- No tests-only completion claim. A Manual-QA artifact is required.",
+	"- **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself — a spawned worker does.",
+	"- No completion claim while an applicable ultraqa adversarial class was never probed. Each applicable class needs a captured observable result; each skipped class needs a one-line not-applicable reason in the ledger.",
+	"- No implementation, review, or merge in the main checkout; every phase works in its task-owned worktree.",
+	"- No unprefixed session ids in Boulder state. Sessions are always recorded as `codex:<session_id>`.",
+	"- No stale-memory execution. The plan and ledger are the durable source of truth.",
+].join("\n");
+const ulwExecuteCodexCompletion = [
+	"When all top-level checkboxes in `## TODOs` and `## Final Verification Wave` are complete:",
+	"",
+	"1. Run the plan's final verification commands.",
+	"2. Record a self-review in the notepad: re-read the diff, run diagnostics, and capture evidence for every acceptance criterion. Run your own manual QA on the real surface.",
+	"3. Only when the user demanded strict, rigorous, or high-accuracy review, spawn ONE `lazycodex-gate-reviewer`; otherwise your self-review is the final verification.",
+	"4. Finish the PR/branch lifecycle from its task-owned worktree: sync `.omo/` state back to the main repo, create or update the PR, wait for review/verification gates, merge by default unless explicitly opted out, and remove the worktree only after successful merge or explicit handoff.",
+	"5. Remove or mark the Boulder work as completed.",
+	"6. Print an `ORCHESTRATION COMPLETE` block with the plan path, verification commands, artifacts, and cleanup receipts.",
+].join("\n");
+const ulwExecuteCodexHardRule = [
+	"- No production change before the tests covering that behavior were read and a bug's reproduction captured; existing tests are green on the unchanged code first, and one that contradicts the intent is a FINDING, never edited green.",
+	"- No `--dry-run` as completion evidence.",
+	"- No tests-only completion claim. A Manual-QA artifact is required.",
+	"- **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself — a spawned worker does.",
+	"- No completion claim while an applicable ultraqa adversarial class was never probed. Each applicable class needs a captured observable result; each skipped class needs a one-line not-applicable reason in the ledger.",
+	"- No implementation, review, or merge in the main checkout; every phase works in a task-owned worktree.",
+	"- No unprefixed session ids in Boulder state. Sessions are always recorded as `codex:<session_id>`.",
+	"- No stale-memory execution. The plan and ledger are the durable source of truth.",
+	"- Codex final verification is the exception to the delegated-QA-only rule above: perform your own manual QA on the real surface and record a self-review before completion.",
+].join("\n");
+
+export function applyCodexSkillOverlays(skillName, content) {
 	if (skillName === "ulw-research") {
 		return content.replace(ulwResearchOriginalDeliveryGates, ulwResearchCodexDeliveryGate);
 	}
-	if (skillName === "start-work") {
+	if (skillName === "ulw-execute") {
 		return content
-			.replace(startWorkOriginalCompletion, startWorkCodexCompletion)
-			.replace(startWorkOriginalHardRule, startWorkCodexHardRule);
+			.replace(ulwExecuteOriginalCompletion, ulwExecuteCodexCompletion)
+			.replace(ulwExecuteOriginalHardRule, ulwExecuteCodexHardRule);
 	}
 	if (skillName === "review-work" && !content.includes("When `review-work` is used as a final implementation")) {
 		return content.replace(reviewWorkAnchor, `${reviewWorkAnchor}${reviewWorkCodexGate}`);
@@ -238,13 +266,27 @@ async function writeCodexSkillDisplayMetadata(skillName) {
 async function adaptSkillForCodex(skillName) {
 	const skillPath = join(skillsRoot, skillName, "SKILL.md");
 	const content = await readFile(skillPath, "utf8");
-	const adapted = applyCodexSkillOverlays(skillName, insertCodexCompatibilityGuidance(content));
+	const needsSpawnPayloadGuidance = ["ulw-loop", "review-work", "ulw-execute"].includes(skillName);
+	const adapted = applyCodexSkillOverlays(skillName, insertCodexCompatibilityGuidance(content, needsSpawnPayloadGuidance));
 	if (adapted !== content) {
 		await writeFile(skillPath, adapted, "utf8");
 	}
 	await writeCodexSkillDisplayMetadata(skillName);
 }
 
+// Read-only inventory shared by generation and shipped-payload validation.
+export async function getSkillOutputManifest() {
+	const sharedSkillEntries = await readdir(sharedSkillsRoot, { withFileTypes: true });
+	const sharedSkillNames = sharedSkillEntries
+		.filter((entry) => entry.isDirectory())
+		.map((entry) => entry.name)
+		.sort();
+	return {
+		root: skillsRoot,
+		names: [...new Set([...componentSkillNames, ...sharedSkillNames])],
+	};
+}
+
 async function syncSkills() {
 	await rm(skillsRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
 	await mkdir(skillsRoot, { recursive: true });
@@ -254,16 +296,21 @@ async function syncSkills() {
 		await adaptSkillForCodex(name);
 	}
 
-	const sharedSkillEntries = await readdir(sharedSkillsRoot, { withFileTypes: true });
-	const sharedSkillNames = sharedSkillEntries
-		.filter((entry) => entry.isDirectory())
-		.map((entry) => entry.name)
-		.sort();
-
-	for (const skillName of sharedSkillNames) {
+	await mkdir(join(skillsRoot, "ultrawork"), { recursive: true });
+	const canonicalUltraworkDirective = await readFile(canonicalUltraworkDirectivePath, "utf8");
+	await writeFile(
+		join(skillsRoot, "ultrawork", "SKILL.md"),
+		`${ultraworkSkillFrontmatter}${canonicalUltraworkDirective}`,
+		"utf8",
+	);
+	await adaptSkillForCodex("ultrawork");
+
+	const { names } = await getSkillOutputManifest();
+	for (const skillName of names) {
 		if (componentSkillNames.has(skillName)) continue;
-		await cp(join(sharedSkillsRoot, skillName), join(skillsRoot, skillName), {
-			filter: shouldCopySkillSource,
+		const sharedSkillSource = join(sharedSkillsRoot, skillName);
+		await cp(sharedSkillSource, join(skillsRoot, skillName), {
+			filter: createSkillSourceCopyFilter(sharedSkillSource),
 			recursive: true,
 		});
 		await adaptSkillForCodex(skillName);

package/packages/omo-codex/plugin/shared/package.json

@@ -13,10 +13,9 @@
 		"typecheck": "tsc --noEmit"
 	},
 	"devDependencies": {
-		"@oh-my-opencode/utils": "file:../../../utils",
-		"@types/node": "^25.9.3",
-		"bun-types": "1.3.14",
-		"typescript": "^6.0.3"
+		"@types/node": "^26.6.2",
+		"bun-types": "1.4.2",
+		"typescript": "^7.0.2"
 	},
 	"engines": {
 		"node": ">=20.0.0"

package/packages/omo-codex/plugin/shared/src/config-loader.ts

@@ -2,8 +2,6 @@ import { homedir } from "node:os"
 
 import {
 	loadOmoConfig,
-	mergeOmoConfigRecords,
-	OmoConfigSchema,
 	type LoadOmoConfigOptions,
 	type MigrationEnvironment,
 	type MigrationFileSystem,
@@ -26,33 +24,11 @@ export type CodexOmoConfigOptions = Omit<LoadOmoConfigOptions, "fileSystem" | "h
 export type CodexStartupMigrationOptions = CodexConfigMigrationOptions
 export type CodexStartupMigrationResult = CodexConfigMigrationResult
 
-type CodexCodegraphConfig = {
-	readonly auto_provision?: boolean
-	readonly daemon?: boolean
-	readonly enabled?: boolean
-	readonly excluded_roots?: readonly string[]
-	readonly install_dir?: string
-	readonly session_start_cooldown_ms?: number
-	readonly telemetry?: boolean
-	readonly watch_debounce_ms?: number
-}
-
-type CodexResolvedConfig = Omit<OmoConfig, "codegraph"> & {
-	readonly codegraph?: CodexCodegraphConfig
-}
-
-export type CodexOmoConfig = CodexResolvedConfig & {
+export type CodexOmoConfig = OmoConfig & {
 	readonly sources: readonly OmoConfigSource[]
-	readonly trustedCodegraphInstallDir?: string
 	readonly warnings: readonly string[]
 }
 
-const ENV_BOOLEAN_SETTINGS = [
-	["auto_provision", "AUTO_PROVISION"],
-	["enabled", "ENABLED"],
-	["telemetry", "TELEMETRY"],
-] as const
-
 function resolveHomeDir(options: CodexOmoConfigOptions): string {
 	const env = options.env ?? process.env
 	return options.homeDir ?? env.HOME ?? env.USERPROFILE ?? homedir()
@@ -74,44 +50,6 @@ export function runCodexStartupMigration(options: CodexStartupMigrationOptions):
 	return runCodexConfigMigration(options)
 }
 
-function parseBoolean(value: string): boolean | undefined {
-	const normalized = value.trim().toLowerCase()
-	if (["1", "true", "yes", "on"].includes(normalized)) return true
-	if (["0", "false", "no", "off"].includes(normalized)) return false
-	return undefined
-}
-
-function envOverrides(env: OmoConfigEnv, warnings: string[]): Record<string, unknown> {
-	const codegraph: Record<string, unknown> = {}
-	for (const prefix of ["OMO", "CODEX"]) {
-		for (const [setting, suffix] of ENV_BOOLEAN_SETTINGS) {
-			const name = `${prefix}_CODEGRAPH_${suffix}`
-			const rawValue = env[name]
-			if (rawValue === undefined) continue
-			const value = parseBoolean(rawValue)
-			if (value === undefined) warnings.push(`${name} has invalid boolean value "${rawValue}"`)
-			else codegraph[setting] = value
-		}
-
-		const installDir = env[`${prefix}_CODEGRAPH_INSTALL_DIR`]
-		if (installDir !== undefined) codegraph["install_dir"] = installDir
-		const cooldown = env[`${prefix}_CODEGRAPH_SESSION_START_COOLDOWN_MS`]
-		if (cooldown !== undefined) {
-			const value = Number(cooldown)
-			if (!Number.isFinite(value) || value < 60_000) {
-				warnings.push(`${prefix}_CODEGRAPH_SESSION_START_COOLDOWN_MS has invalid number value "${cooldown}"`)
-			} else codegraph["session_start_cooldown_ms"] = value
-		}
-		const debounce = env[`${prefix}_CODEGRAPH_WATCH_DEBOUNCE_MS`]
-		if (debounce !== undefined) {
-			const value = Number(debounce)
-			if (!Number.isFinite(value) || value < 0) warnings.push(`${prefix}_CODEGRAPH_WATCH_DEBOUNCE_MS has invalid number value "${debounce}"`)
-			else codegraph["watch_debounce_ms"] = value
-		}
-	}
-	return Object.keys(codegraph).length === 0 ? {} : { codegraph }
-}
-
 function migrationWarnings(result: CodexStartupMigrationResult): readonly string[] {
 	const warnings: string[] = []
 	if (result.error !== undefined) warnings.push(`omo-codex: configuration migration: ${result.error}`)
@@ -127,26 +65,6 @@ function migrationWarnings(result: CodexStartupMigrationResult): readonly string
 	return warnings
 }
 
-function applicabilityWarnings(config: OmoConfig): readonly string[] {
-	return config.codegraph?.watch_debounce_ms === undefined
-		? []
-		: ["codegraph.watch_debounce_ms is not supported for harness codex"]
-}
-
-function codexCodegraphConfig(value: OmoConfig["codegraph"]): CodexCodegraphConfig | undefined {
-	if (value === undefined) return undefined
-	return {
-		auto_provision: value.auto_provision,
-		daemon: value.daemon,
-		enabled: value.enabled,
-		telemetry: value.telemetry,
-		...(value.excluded_roots === undefined ? {} : { excluded_roots: value.excluded_roots }),
-		...(value.install_dir === undefined ? {} : { install_dir: value.install_dir }),
-		...(value.session_start_cooldown_ms === undefined ? {} : { session_start_cooldown_ms: value.session_start_cooldown_ms }),
-		...(value.watch_debounce_ms === undefined ? {} : { watch_debounce_ms: value.watch_debounce_ms }),
-	}
-}
-
 export function getCodexOmoConfig(options: CodexOmoConfigOptions = {}): CodexOmoConfig {
 	const env = options.env ?? process.env
 	const homeDir = resolveHomeDir(options)
@@ -166,30 +84,12 @@ export function getCodexOmoConfig(options: CodexOmoConfigOptions = {}): CodexOmo
 		...(options.platform === undefined ? {} : { platform: options.platform }),
 		...(options.profile === undefined ? {} : { profile: options.profile }),
 	})
-	const trustedConfig = loadOmoConfig({
-		cwd: homeDir,
-		env: environment,
-		...(options.fileSystem === undefined ? {} : { fileSystem: options.fileSystem }),
-		harness: "codex",
-		...(options.platform === undefined ? {} : { platform: options.platform }),
-		...(options.profile === undefined ? {} : { profile: options.profile }),
-	})
-	const envWarnings: string[] = []
-	const config = OmoConfigSchema.parse(mergeOmoConfigRecords(result.config, envOverrides(env, envWarnings)))
-	const trustedCodegraphInstallDir = trustedConfig.config.codegraph?.install_dir
-	const { codegraph, ...resolvedConfig } = config
-	const codexCodegraph = codexCodegraphConfig(codegraph)
-
 	return {
-		...resolvedConfig,
-		...(codexCodegraph === undefined ? {} : { codegraph: codexCodegraph }),
+		...result.config,
 		sources: result.sources,
-		...(trustedCodegraphInstallDir === undefined ? {} : { trustedCodegraphInstallDir }),
 		warnings: [
 			...migrationWarnings(migration),
 			...result.diagnostics.map((diagnostic) => diagnostic.message),
-			...envWarnings,
-			...applicabilityWarnings(config),
 		],
 	}
 }

package/packages/omo-codex/plugin/shared/src/config-migration.ts

@@ -83,7 +83,6 @@ function transformConfigJsonc(configPath: string, sources: readonly LoadedMigrat
 			: [],
 		document: {
 			$schema: OMO_SCHEMA_URL,
-			...(recordAt(legacy, "codegraph") === undefined ? {} : { codegraph: recordAt(legacy, "codegraph") }),
 			...(recordAt(legacy, "[opencode]") === undefined ? {} : { "[opencode]": recordAt(legacy, "[opencode]") }),
 			...(recordAt(legacy, "[codex]") === undefined ? {} : { "[codex]": recordAt(legacy, "[codex]") }),
 			...(senpi === undefined && omo === undefined ? {} : { "[senpi]": senpi ?? omo }),