opencode-agent-skill 14.4.0 → 15.0.0

package/global-config/skills/engineering-orchestrator/references/long-horizon.md

@@ -13,6 +13,11 @@ When the user explicitly chooses the long-horizon workflow (for example with `/u
   STATE.json
   EVIDENCE.json
   EVENTS.jsonl
+  EXECUTION_CONTRACT.json
+  FINAL_VERDICTS.json
+  phases/
+    MANIFEST.json
+    phase-XX-<slug>.json
   tasks/
   reports/
 ```
@@ -21,11 +26,15 @@ The directory is git-ignored execution state, not hidden reasoning. Store requir
 
 ## Machine-enforced gates
 
-The V6 engine enforces three boundaries:
+The runtime enforces seven boundaries:
 
-1. **Plan gate** — `work plan` leaves the item in `awaiting-plan-approval`. Long/high-risk plans require a structured `plan-verification` receipt bound to the current plan hash before `work approve-plan` succeeds.
-2. **Concurrent state gate** — all mutable `STATE.json` and `EVIDENCE.json` operations use a per-work-item lock plus atomic file replacement, preventing safe-wave executors from losing each other's state.
-3. **Integration gate** — long/high-risk PASS requires a structured `integration-verification` receipt bound to the current workspace fingerprint. Finalization rejects any later workspace change.
+1. **Inherited-work gate** — snapshot source-facing dirty paths before planning. UES children may not discard them with restore/checkout/stash/clean/reset, and planned writers must declare every touched file.
+2. **Local-env gate** — local `.env*` runtime inputs are no-write by default; only explicit user authorization permits local env mutation. Repository templates remain writable.
+3. **Plan gate** — `work plan` leaves the item in `awaiting-plan-approval`. Long/high-risk plans require a structured `plan-verification` receipt bound to the current plan hash before `work approve-plan` succeeds.
+4. **Phase gate** — explicit execution phases become deterministic previous-phase barriers. Constraint-only phases stay global invariants.
+5. **Concurrent state gate** — all mutable `STATE.json` and `EVIDENCE.json` operations use a per-work-item lock plus atomic file replacement, preventing safe-wave executors from losing each other's state.
+6. **Integration gate** — long/high-risk source completion requires a structured `integration-verification` receipt bound to the current workspace fingerprint. Finalization rejects any later workspace change.
+7. **Verdict matrix gate** — source, runtime, database cleanup and real-device proof remain independent. Missing required evidence is reported as not verified rather than promoted to PASS.
 
 ## Pipeline
 
@@ -33,18 +42,19 @@ The V6 engine enforces three boundaries:
 2. Write observable acceptance criteria into `SPEC.md`.
 3. Initialize state with `ocskill work init`.
 4. Create `PLAN.json` following the plan schema and import it with `ocskill work plan`.
-5. Run `ues-plan-checker`. If it returns PASS, create `work gate-receipt <slug> plan` and persist approval with `work approve-plan --receipt-file ...`.
-6. Use `ocskill task-graph` to compute dependency-safe waves.
-7. For each ready task:
+5. If the user supplied explicit `PHASE N` sections, preserve every execution phase in the plan and let UES add phase barriers; constraint-only phases remain invariants.
+6. Run `ues-plan-checker`. If it returns PASS, create `work gate-receipt <slug> plan` and persist approval with `work approve-plan --receipt-file ...`.
+7. Persist the execution contract/phase artifacts and use `ocskill task-graph` to compute dependency-safe waves.
+8. For each ready task:
    - on OpenCode V2, if two or more approved tasks are independent, prefer `ues.dispatch_parallel` so one shared model can execute them concurrently with isolated worktrees, leases, independent verifier sessions and serialized integration;
    - otherwise prefer `ues.dispatch_task`, which performs `work start`, creates a fresh `ues-executor` session, selects the configured attempt-based model tier, prompts it with a bounded context pack and waits for completion;
    - inspect the child diff and verification;
    - record at least one successful `work verify-command` receipt for long/high-risk work;
    - persist `work complete --evidence ...` or `work fail --reason ...`.
-8. On failure, re-diagnose rather than stacking patches. A later `ues.dispatch_task` attempt can escalate from standard to heavy when configured.
-9. After all tasks complete, run `ues-integration-verifier`.
-10. Persist the verifier's actual result with a structured integration receipt plus `ocskill work verify-integration --receipt-file ...`.
-11. Only a recorded PASS with an unchanged workspace can be finalized.
+9. On failure, re-diagnose rather than stacking patches. A later `ues.dispatch_task` attempt can escalate from standard to heavy when configured.
+10. After all tasks complete, run `ues-integration-verifier`.
+11. Persist the verifier's actual result with a structured integration receipt plus `ocskill work verify-integration --receipt-file ...`.
+12. Emit the independent final verdict matrix and persist `FINAL_VERDICTS.json`. Only a recorded PASS with an unchanged workspace can be finalized.
 
 ## Parallelism
 

package/lib/activity-deadline.mjs

@@ -0,0 +1,70 @@
+function finite(value, fallback, min = 0, max = Number.MAX_SAFE_INTEGER) {
+  const parsed = Number(value)
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.max(min, Math.min(max, Math.trunc(parsed)))
+}
+
+export function createAdaptiveDeadline(options = {}, startedAt = Date.now()) {
+  const initialMs = finite(options.hardTimeoutMs, 60_000, 1_000)
+  const absoluteMs = Math.max(
+    initialMs,
+    finite(options.absoluteHardTimeoutMs, initialMs, initialMs),
+  )
+  const extensionMs = finite(options.activityExtensionMs, 0, 0, absoluteMs)
+  const activityWindowMs = finite(
+    options.activityWindowMs,
+    Math.max(5_000, Math.min(extensionMs || initialMs, 30_000)),
+    1_000,
+    absoluteMs,
+  )
+
+  let deadlineAt = startedAt + initialMs
+  const absoluteAt = startedAt + absoluteMs
+  let extensions = 0
+
+  function maybeExtend(now = Date.now(), lastActivityAt = 0) {
+    if (extensionMs <= 0 || deadlineAt >= absoluteAt) {
+      return { extended: false, deadlineAt, absoluteAt, extensions }
+    }
+    if (now - Number(lastActivityAt || 0) > activityWindowMs) {
+      return { extended: false, deadlineAt, absoluteAt, extensions }
+    }
+    const next = Math.min(absoluteAt, Math.max(deadlineAt, now + extensionMs))
+    if (next <= deadlineAt) {
+      return { extended: false, deadlineAt, absoluteAt, extensions }
+    }
+    deadlineAt = next
+    extensions += 1
+    return { extended: true, deadlineAt, absoluteAt, extensions }
+  }
+
+  function shouldAbort(now = Date.now(), lastActivityAt = 0) {
+    if (now < deadlineAt) {
+      return { abort: false, deadlineAt, absoluteAt, extensions }
+    }
+    const extension = maybeExtend(now, lastActivityAt)
+    if (extension.extended) {
+      return { abort: false, ...extension }
+    }
+    return {
+      abort: true,
+      reason: now >= absoluteAt ? "absolute-hard-timeout" : "hard-timeout",
+      deadlineAt,
+      absoluteAt,
+      extensions,
+    }
+  }
+
+  return {
+    startedAt,
+    initialMs,
+    absoluteMs,
+    extensionMs,
+    activityWindowMs,
+    get deadlineAt() { return deadlineAt },
+    get absoluteAt() { return absoluteAt },
+    get extensions() { return extensions },
+    maybeExtend,
+    shouldAbort,
+  }
+}

package/lib/adaptive-context-budget.mjs

@@ -59,20 +59,35 @@ export function adaptiveContextBudget(taskPolicy = {}, role = "executor", attemp
   const profile = String(taskPolicy.executionProfile || taskPolicy.profile?.name || "standard")
   const highRisk = taskPolicy.risk === "high" || taskPolicy.risk === "critical"
 
-  // High-risk work keeps the original evidence budget. Turbo mode must not trade
-  // away security/payment/schema evidence for latency.
-  if (highRisk || options.disabled === true) {
+  if (options.disabled === true) {
     return {
       schemaVersion: 1,
       budget: base,
       baseBudget: base,
       adaptive: false,
-      reason: highRisk ? "high-risk-preserves-base-budget" : "disabled",
+      reason: "disabled",
     }
   }
 
   const table = ROLE_TARGETS[profile] || ROLE_TARGETS.standard
   const target = clamp(table?.[role], base, 4_000, base)
+  const plannerRole = role === "architect" || role === "plan-checker"
+
+  // High-risk execution/verification keeps the full evidence ceiling. Read-only
+  // planning roles are allowed a bounded context because they can use targeted
+  // repository tools and are independently plan-gated before any write begins.
+  if (highRisk && !plannerRole) {
+    return {
+      schemaVersion: 1,
+      budget: base,
+      baseBudget: base,
+      adaptive: false,
+      reason: "high-risk-execution-preserves-base-budget",
+      profile,
+      role,
+      attempt: Math.max(1, Math.trunc(Number(attempt || 1))),
+    }
+  }
   const normalizedAttempt = Math.max(1, Math.trunc(Number(attempt || 1)))
 
   // Failed attempts expand deterministically back toward the policy ceiling.
@@ -92,6 +107,11 @@ export function adaptiveContextBudget(taskPolicy = {}, role = "executor", attemp
     profile,
     role,
     attempt: normalizedAttempt,
-    reason: budget < base ? "role-bounded-expand-on-failure" : "policy-ceiling",
+    reason:
+      highRisk && plannerRole
+        ? "high-risk-planner-role-bounded"
+        : budget < base
+          ? "role-bounded-expand-on-failure"
+          : "policy-ceiling",
   }
 }

package/lib/affected-tests.mjs

@@ -6,7 +6,7 @@ import { runtimeWorkspaceFingerprint } from "./workspace-fingerprint.mjs"
 
 const TEST_RE = /(?:^|[/.\\])(?:__tests__|tests?|spec)(?:[/.\\]|$)|\.(?:test|spec|e2e-spec)\.[cm]?[jt]sx?$/i
 const SOURCE_EXT = new Set([".js",".jsx",".mjs",".cjs",".ts",".tsx",".py",".java",".kt",".kts",".cs",".go",".rs",".dart",".swift"])
-const SKIP = new Set([".git","node_modules",".next","dist","build","coverage",".venv","venv","target","Pods","DerivedData",".gradle",".ues-cache",".ues-work",".ues-sandboxes",".ues-traces",".ues-learning",".ues-dashboard",".ues-memory",".ues-evals"])
+const SKIP = new Set([".git","node_modules",".next","dist","build","coverage",".venv","venv","target","Pods","DerivedData",".gradle",".ues-cache",".ues-work",".ues-sandboxes",".ues-traces",".ues-learning",".ues-dashboard",".ues-memory",".ues-evals",".ues-services"])
 const AFFECTED_TEST_CACHE = new Map()
 const AFFECTED_TEST_INFLIGHT = new Map()
 

package/lib/capability-fabric.mjs

@@ -129,6 +129,23 @@ export function defaultCapabilityRegistry(root = process.cwd()) {
       "context.reversible": [
         { id: "ues-evidence-context", kind: "builtin", priority: 120, quality: 0.98, costClass: "low", latencyClass: "fast", metadata: { reversible: true, searchable: true, levels: ["T1", "T2", "T3", "raw"] } },
       ],
+      "runtime.service": [
+        {
+          id: "ues-managed-service",
+          kind: "builtin",
+          priority: 125,
+          quality: 0.98,
+          costClass: "low",
+          latencyClass: "fast",
+          metadata: {
+            shellFree: true,
+            readiness: ["port", "log", "process"],
+            actions: ["start", "wait-ready", "status", "logs", "stop", "restart"],
+            boundedLifetime: true,
+            evidenceLogs: true,
+          },
+        },
+      ],
       memory: [
         { id: "ues-memory", kind: "builtin", priority: 100, quality: 0.9, costClass: "low", latencyClass: "fast" },
       ],

package/lib/completion-auditor.mjs

@@ -11,13 +11,30 @@ function passRun(run) {
   return Boolean(run && Number(run.exitCode) === 0 && run.verdict === "PASS")
 }
 
-function benignEmptySection(value) {
-  const normalized = text(value)
+function normalizeSection(value) {
+  return text(value)
     .toLowerCase()
     .replace(/[`*_#]/g, "")
     .replace(/[.!:;]+$/g, "")
+    .replace(/\s+/g, " ")
     .trim()
-  return !normalized || /^(?:none(?: observed| found| remaining)?|n\/a|na|nil|0|no failures?(?: observed| found| remaining)?|no unresolved gaps?(?: observed| found| remaining)?|no gaps?(?: observed| found| remaining)?|not applicable)$/.test(normalized)
+}
+
+function benignEmptySection(value) {
+  const normalized = normalizeSection(value)
+  return !normalized || /^(?:none(?: observed| found| remaining)?|n\/a|na|nil|0|no failures?(?: observed| found| remaining)?|no unresolved gaps?(?: observed| found| remaining)?|no gaps?(?: observed| found| remaining)?|not applicable|không có|không có gì|không có lỗi|không phát hiện lỗi|không còn khoảng trống|không có khoảng trống)$/.test(normalized)
+}
+
+function benignFailureSection(value) {
+  const normalized = normalizeSection(value)
+  return benignEmptySection(normalized) ||
+    /^(?:không có|không phát hiện) .{0,120}(?:lỗi|thất bại)(?: nào)?$/.test(normalized)
+}
+
+function outOfScopeGapOnly(value) {
+  const normalized = normalizeSection(value)
+  if (benignEmptySection(normalized)) return true
+  return /(?:not requested|outside (?:the )?scope|out of scope|not required|không có yêu cầu|không được yêu cầu|ngoài phạm vi|không thuộc phạm vi)/.test(normalized)
 }
 
 function receiptPassed(row = {}) {
@@ -43,8 +60,11 @@ export function auditCompletion(input = {}) {
   for (const key of ["checks-run", "acceptance-criteria-proven", "completion-evidence"]) {
     if (!text(sections[key])) failures.push(`missing-report-section:${key}`)
   }
-  if (Object.hasOwn(sections, "failures") && !benignEmptySection(sections.failures)) failures.push("verification-reports-failures")
-  if (Object.hasOwn(sections, "unresolved-gaps") && !benignEmptySection(sections["unresolved-gaps"])) failures.push("verification-reports-unresolved-gaps")
+  if (Object.hasOwn(sections, "failures") && !benignFailureSection(sections.failures)) failures.push("verification-reports-failures")
+  if (Object.hasOwn(sections, "unresolved-gaps") && !benignEmptySection(sections["unresolved-gaps"])) {
+    if (outOfScopeGapOnly(sections["unresolved-gaps"])) warnings.push("verification-reports-out-of-scope-gap")
+    else failures.push("verification-reports-unresolved-gaps")
+  }
   if (Object.hasOwn(sections, "checks-not-run") && !benignEmptySection(sections["checks-not-run"])) warnings.push("verification-reports-checks-not-run")
 
   const snapshot = input.workspaceSnapshot || null

package/lib/evidence-store.mjs

@@ -5,6 +5,41 @@ import path from "node:path"
 
 const STORE_VERSION = 1
 const REF_PREFIX = "evidence:sha256:"
+const DEFAULT_MAX_STORE_BYTES = 192 * 1024 * 1024
+const DEFAULT_MAX_STORE_ENTRIES = 1200
+const DEFAULT_MAX_STORE_AGE_DAYS = 14
+const AUTO_GC_EVERY_WRITES = 8
+const AUTO_GC_LARGE_ITEM_BYTES = 16 * 1024 * 1024
+const PUT_COUNTS = new Map()
+
+function boundedNumber(value, fallback, min, max) {
+  const parsed = Number(value)
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.max(min, Math.min(max, Math.trunc(parsed)))
+}
+
+function defaultStoreLimits() {
+  return {
+    maxBytes: boundedNumber(
+      process.env.UES_EVIDENCE_MAX_BYTES,
+      DEFAULT_MAX_STORE_BYTES,
+      16 * 1024 * 1024,
+      2 * 1024 * 1024 * 1024,
+    ),
+    maxEntries: boundedNumber(
+      process.env.UES_EVIDENCE_MAX_ENTRIES,
+      DEFAULT_MAX_STORE_ENTRIES,
+      100,
+      20_000,
+    ),
+    maxAgeDays: boundedNumber(
+      process.env.UES_EVIDENCE_MAX_AGE_DAYS,
+      DEFAULT_MAX_STORE_AGE_DAYS,
+      1,
+      365,
+    ),
+  }
+}
 
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue)
@@ -21,6 +56,24 @@ function toBytes(value, options = {}) {
   return { bytes: Buffer.from(text, "utf8"), encoding: "utf8", mediaType: options.mediaType || "application/json" }
 }
 
+async function protectedEvidenceHashes(root) {
+  const file = path.join(path.resolve(root), ".ues-memory", "MEMORY.json")
+  const parsed = await readFile(file, "utf8")
+    .then((raw) => JSON.parse(raw))
+    .catch(() => null)
+  const protectedHashes = new Set()
+  const now = Date.now()
+  for (const memory of parsed?.memories || []) {
+    if (memory?.status !== "verified" || memory?.supersededBy) continue
+    const expiresAt = Date.parse(String(memory?.expiresAt || ""))
+    if (expiresAt && expiresAt <= now) continue
+    for (const ref of memory?.evidenceRefs || []) {
+      try { protectedHashes.add(normalizeHash(ref)) } catch {}
+    }
+  }
+  return protectedHashes
+}
+
 function normalizeHash(ref) {
   const value = String(ref || "").trim()
   const hash = value.startsWith(REF_PREFIX) ? value.slice(REF_PREFIX.length) : value.replace(/^sha256:/, "")
@@ -79,6 +132,13 @@ export async function putEvidence(root, value, options = {}) {
     preview,
   }
   await writeFile(target.meta, JSON.stringify(metadata, null, 2) + "\n", "utf8")
+
+  const writes = (PUT_COUNTS.get(root) || 0) + 1
+  PUT_COUNTS.set(root, writes)
+  if (writes % AUTO_GC_EVERY_WRITES === 0 || encoded.bytes.length >= AUTO_GC_LARGE_ITEM_BYTES) {
+    await gcEvidenceStore(root, defaultStoreLimits()).catch(() => null)
+  }
+
   return metadata
 }
 
@@ -216,25 +276,44 @@ export async function evidenceStoreStatus(root = process.cwd()) {
 }
 
 export async function gcEvidenceStore(root = process.cwd(), options = {}) {
+  root = path.resolve(root)
   const files = await metadataFiles(root)
-  const maxEntries = Math.max(10, Number(options.maxEntries || 2_000))
-  const maxAgeMs = Math.max(0, Number(options.maxAgeDays ?? 30)) * 86_400_000
+  const defaults = defaultStoreLimits()
+  const maxEntries = Math.max(10, Number(options.maxEntries ?? defaults.maxEntries))
+  const maxBytes = Math.max(1024 * 1024, Number(options.maxBytes ?? defaults.maxBytes))
+  const maxAgeMs = Math.max(0, Number(options.maxAgeDays ?? defaults.maxAgeDays)) * 86_400_000
   const now = Date.now()
+  const protectedHashes = options.protectMemoryRefs === false
+    ? new Set()
+    : await protectedEvidenceHashes(root)
   const rows = []
   for (const metaFile of files) {
     const meta = JSON.parse(await readFile(metaFile, "utf8").catch(() => "{}"))
     const time = Date.parse(meta.lastSeenAt || meta.createdAt || 0) || 0
-    rows.push({ metaFile, meta, time })
+    rows.push({ metaFile, meta, time, bytes: Math.max(0, Number(meta.bytes || 0)) })
   }
   rows.sort((a, b) => b.time - a.time)
 
   const removed = []
-  for (let index = 0; index < rows.length; index += 1) {
-    const row = rows[index]
-    const tooMany = index >= maxEntries
+  let retainedEntries = 0
+  let retainedBytes = 0
+  let protectedEntries = 0
+  let protectedBytes = 0
+  for (const row of rows) {
+    const hash = normalizeHash(row.meta.sha256 || path.basename(row.metaFile, ".json"))
+    const protectedByMemory = protectedHashes.has(hash)
+    const tooMany = retainedEntries >= maxEntries
     const tooOld = maxAgeMs > 0 && row.time > 0 && now - row.time > maxAgeMs
-    if (!tooMany && !tooOld) continue
-    const hash = row.meta.sha256 || path.basename(row.metaFile, ".json")
+    const tooLarge = retainedBytes + row.bytes > maxBytes
+    if (protectedByMemory || (!tooMany && !tooOld && !tooLarge)) {
+      retainedEntries += 1
+      retainedBytes += row.bytes
+      if (protectedByMemory) {
+        protectedEntries += 1
+        protectedBytes += row.bytes
+      }
+      continue
+    }
     const target = evidencePaths(root, hash)
     await rm(target.meta, { force: true })
     await rm(target.data, { force: true })
@@ -244,6 +323,11 @@ export async function gcEvidenceStore(root = process.cwd(), options = {}) {
   return {
     removed,
     removedCount: removed.length,
+    retainedEntries,
+    retainedBytes,
+    protectedEntries,
+    protectedBytes,
+    limits: { maxEntries, maxBytes, maxAgeMs },
     status: await evidenceStoreStatus(root),
   }
 }