opencode-agent-skill 14.4.0 → 15.1.0

package/scripts/check-release-consistency.mjs

@@ -113,7 +113,7 @@ export function checkReleaseConsistency(root = DEFAULT_ROOT) {
 
   const piCompat = requireText(errors, readText(root, path.join("docs", "PI-COMPAT.md")), "docs/PI-COMPAT.md")
   if (piCompat) {
-    for (const marker of ["# Pi Agent runtime", "ues_execute", "ues_dispatch", "ues_cli", "manifest is Pi-only", "V14.2 Turbo Weak-Model Runtime"]) {
+    for (const marker of ["# Pi Agent runtime", "ues_execute", "ues_dispatch", "ues_cli", "manifest is Pi-only", "V14.2 Turbo Weak-Model Runtime", "V15.1 deterministic admission and managed services", "V15.2 Turbo Fast Path", "V15.3 DEEP Speed", "V15.4 ACP-safe child runtime", "V15.5 Per-Leaf Turbo", "V15.6 Fast Planning", "V15.7 Lightweight Sandbox Cleanup", "V15.8 Plan Gate Recovery", "V15.9 Runtime Artifact Isolation", "V15.10 Adaptive Stability Runtime", "V15.11 Session Identity Sync", "V15.12 Safe Autopilot + Disk Hygiene", "V15.13 Read-Only Completion Semantics", "V15.14 Deterministic Read-Only Fast Path", "V15.15 Execution Contracts + Phase Gates", "V15.16 Portable Cross-Tool Temp Paths", "V15.17 Zero-Friction Autopilot Admission", "V15.18 Three-Tier Zero-Friction Routing", "V15.19 Finalization Hardening", "ues_service"]) {
       if (!piCompat.includes(marker)) errors.push(`docs/PI-COMPAT.md: missing current Pi contract marker ${marker}`)
     }
   }
@@ -137,6 +137,7 @@ export function checkReleaseConsistency(root = DEFAULT_ROOT) {
   if (canonicalPolicy) {
     if (!/export function classifyEngineeringTask/.test(canonicalPolicy)) errors.push("lib/task-policy.mjs: missing classifyEngineeringTask")
     if (!/export function recoveryPolicyForAttempt/.test(canonicalPolicy)) errors.push("lib/task-policy.mjs: missing recoveryPolicyForAttempt")
+    if (!/CONCRETE_DIAGNOSIS/.test(canonicalPolicy) || !/diagnosisEvidence/.test(canonicalPolicy)) errors.push("lib/task-policy.mjs: missing V15.3 diagnosis deduplication contract")
   }
 
   if (pkg) {
@@ -146,6 +147,24 @@ export function checkReleaseConsistency(root = DEFAULT_ROOT) {
     if (scripts["docs:check"] !== "node scripts/check-release-consistency.mjs") errors.push("package.json: missing docs:check release-consistency script")
     if (scripts["release:check-tag"] !== "node scripts/check-release-tag.mjs") errors.push("package.json: missing release:check-tag script")
     if (scripts["eval:pi"] !== "node scripts/eval-pi.mjs") errors.push("package.json: missing Pi-native eval:pi script")
+    const focusedV15 = String(scripts["eval:v15"] || "").trim().split(/\s+/).filter(Boolean)
+    const requiredFocusedV15Tests = [
+      "test/v15-runtime.test.mjs",
+      "test/trajectory.test.mjs",
+      "test/evidence-store-v11.test.mjs",
+      "test/runtime-events.test.mjs",
+      "test/v14.3-intelligence.test.mjs",
+      "test/v14.2-runtime.test.mjs",
+      "test/pi-package.test.mjs",
+      "test/execution-contract.test.mjs",
+    ]
+    if (
+      focusedV15[0] !== "node" ||
+      focusedV15[1] !== "--test" ||
+      !requiredFocusedV15Tests.every((file) => focusedV15.includes(file))
+    ) {
+      errors.push("package.json: focused eval:v15 must run the current V15 runtime, disk-safety, intelligence and Pi-package regression set")
+    }
     if (!String(scripts.ci || "").includes("npm run integrity")) errors.push("package.json: ci must include source-integrity gate")
     if (scripts["runtime:exports"] !== "node scripts/check-runtime-exports.mjs") errors.push("package.json: missing runtime:exports import/export gate")
     if (!String(scripts.ci || "").includes("npm run runtime:exports")) errors.push("package.json: ci must include runtime export gate")
@@ -157,11 +176,15 @@ export function checkReleaseConsistency(root = DEFAULT_ROOT) {
     if (!Array.isArray(pkg.pi?.prompts) || !pkg.pi.prompts.includes("./pi/prompts/*.md")) errors.push("package.json: Pi prompts entry drift")
     if (!Array.isArray(pkg.files) || !pkg.files.includes("global-config/AGENTS.md")) errors.push("package.json: installer runtime data global-config/AGENTS.md must be packed")
     if (!pkg.files.includes("docs/V14.2-TURBO-WEAK-MODEL-RUNTIME.md")) errors.push("package.json: V14.2 runtime documentation must be packed")
+    if (!pkg.files.includes("docs/V15-MANAGED-RUNTIME.md")) errors.push("package.json: V15 managed-runtime documentation must be packed")
     if (scripts["smoke:packed"] !== "node scripts/smoke-packed-install.mjs") errors.push("package.json: missing smoke:packed integration script")
   }
 
   if (skillCount < 40) warnings.push(`skill catalog unexpectedly small: ${skillCount}`)
-  if (promptCount < 10) warnings.push(`Pi prompt catalog unexpectedly small: ${promptCount}`)
+  if (promptCount !== 10) errors.push(`Pi must expose exactly 10 prompt templates; /ues-run is an extension command, found ${promptCount}`)
+  if (existsSync(path.join(root, "pi", "prompts", "ues-run.md"))) {
+    errors.push("pi/prompts/ues-run.md must not exist because it duplicates the deterministic extension /ues-run command")
+  }
 
   return {
     pass: errors.length === 0,

package/scripts/check-source-integrity.mjs

@@ -19,10 +19,89 @@ const CONTRACTS = [
       "McpHealthTracker",
       "MCP_HEALTH",
       "auditCompletion",
+      'pi.registerCommand("ues-status"',
+      'pi.registerCommand("ues-run"',
+      "UES parent tools are hidden outside admitted UES runs",
+      "Zero-friction engineering admission",
+      "directControllerRunner",
+      "automaticUesAdmission",
+      "automaticUesContinuation",
+      "safe continuation",
+      "natural continuation forwarded to the active child",
+      "prompt was not swallowed",
+      "native / auto / high-risk",
+      "admissionDecision",
+      "__taskPolicy",
+      "void directControllerRunner",
+      "UES_AUTO_ADMIT",
+      "UES_PARENT_TOOL_NAMES",
+      "pi.getActiveTools",
+      "pi.setActiveTools",
+      "deactivateParentUesTools",
+      "activateParentUesTools",
+      'pi.on("before_agent_start"',
+      "requireGitWorkspaceRoot",
+      "read-only-workspace-mutated",
+      "auto-revised the rejected plan",
+      "Removed transient runtime dirs",
+      "gcEvidenceStore",
+      'entry.name === "evidence-v1"',
+      "Protected verified-memory evidence",
+      "MAX_WRITER_CONCURRENCY",
+      "UES_MAX_WRITER_CONCURRENCY",
+      "taskSandboxOwnerRoot",
+      "pi.setSessionName",
+      "sessionNameFromUesInput",
+      'uesSessionName("run", task, workspaceRoot)',
+      "PACKAGE_VERSION",
+      'name: "ues_service"',
+      "looksLikeLongRunningServiceCommand",
+      "ues_controller_direct",
+      "ues_controller_progress",
+      "taskPolicyOverride || classifyEngineeringTask",
+      "turboFastPathDecision",
+      "deepExplorationContract",
+      "resolvePiChildInvocation",
+      "leafTaskPolicy",
+      "failureDelta",
+      "UES Per-Leaf Turbo",
+      "contextCacheNamespace",
+      "planningRuntimeBudget",
+      "shouldSoftSteerArchitect",
+      "pruneOrphanTaskSandboxes",
+      "planning fast-stop",
+      "ACTIVE_TASK_SANDBOXES",
+      "cleanupTraceSandboxes",
+      "ues-clean",
+      "reclaimOwnerPid",
+      "sourceFacingPaths",
+      "sourceGitPathspecs",
+      "sandboxIntentToAddSourceFiles",
+      "--exclude-standard",
+      "changed real source files outside declared write scope",
+      "Do not silently broaden scope",
+      "extractValidatedPlan",
+      "absoluteHardTimeoutMs",
+      "activityExtensionMs",
+      "UES planning salvage",
+      "first substantive output",
+      "partialOutput",
+      "UES DEEP bounded exploration",
+      "DEEP efficiency rule",
+      "TURBO_FAST_TIMEOUTS",
+      "process.stderr.write",
       "CHILD_RUNTIME_EXTENSION",
       "isAbortedRun",
       "abortedResponse",
       'reason: "aborted"',
+      "buildExecutionContract",
+      "captureInheritedDirtyState",
+      "detectInheritedDirtyViolations",
+      "enforcePhaseGates",
+      "inherited dirty-work guard stopped completion",
+      "FINAL_VERDICTS.json",
+      "UES_CHILD_ALLOW_LOCAL_ENV_WRITE",
+      "Independent final verdict matrix: on",
     ],
   },
   {
@@ -35,11 +114,21 @@ const CONTRACTS = [
       'name: "ues_evidence_get"',
       'name: "ues_code"',
       'name: "ues_code_edit"',
+      'name: "ues_service"',
+      'process.env.UES_CHILD_PROCESS !== "1"',
+      "looksLikeLongRunningServiceCommand",
+      "stopAllServices",
       "applyAnchoredFileEdits",
       "diagnoseCode",
       "recordVerification",
       "canonicalVerificationCommand",
       "destructiveShellRisk",
+      "isLocalEnvPath",
+      "localEnvWriteRisk",
+      "crossToolTempPathRisk",
+      "portable temp-path guard",
+      "UES_CHILD_ALLOW_LOCAL_ENV_WRITE",
+      "NEEDS_USER_ENV",
     ],
   },
   {
@@ -87,7 +176,7 @@ const CONTRACTS = [
     file: "lib/evidence-store.mjs",
     minBytes: 7_500,
     startsWith: "import ",
-    required: ["putEvidence", "getEvidence", "getEvidenceSelected"],
+    required: ["putEvidence", "getEvidence", "getEvidenceSelected", "DEFAULT_MAX_STORE_BYTES", "maxBytes", "AUTO_GC_EVERY_WRITES", "protectedEvidenceHashes", "protectedEntries"],
   },
   {
     file: "lib/process-supervisor.mjs",
@@ -95,17 +184,166 @@ const CONTRACTS = [
     startsWith: "import ",
     required: ["terminateProcessTree", "runSupervisedProcess", "drainTimeoutMs"],
   },
+  {
+    file: "lib/activity-deadline.mjs",
+    minBytes: 1_500,
+    startsWith: "function finite",
+    required: [
+      "createAdaptiveDeadline",
+      "absoluteHardTimeoutMs",
+      "activityExtensionMs",
+      "activityWindowMs",
+      "absolute-hard-timeout",
+      "hard-timeout",
+    ],
+  },
+  {
+    file: "lib/plan-salvage.mjs",
+    minBytes: 2_000,
+    startsWith: "import ",
+    required: [
+      "extractValidatedPlan",
+      "normalizePlanForValidation",
+      "validatePlan",
+      "unmarked-balanced",
+      "fenced",
+      "salvaged",
+    ],
+  },
+  {
+    file: "lib/runtime-artifacts.mjs",
+    minBytes: 800,
+    startsWith: "export const UES_RUNTIME_DIRS",
+    required: [
+      "isUesRuntimeArtifactPath",
+      "sourceFacingPaths",
+      "sourceGitPathspecs",
+      ".ues-traces",
+      ".ues-cache",
+      ".ues-services",
+      ".ues-work",
+    ],
+  },
+  {
+    file: "lib/runtime-events.mjs",
+    minBytes: 1_200,
+    startsWith: 'import { randomUUID }',
+    required: [
+      "appendRuntimeEvent",
+      "readRuntimeEvents",
+      "DEFAULT_MAX_EVENT_FILE_BYTES",
+      "runtime-events.compacted",
+      "UES_EVENT_LOG_MAX_BYTES",
+    ],
+  },
+  {
+    file: "lib/workspace-root.mjs",
+    minBytes: 900,
+    startsWith: 'import { spawnSync }',
+    required: [
+      "resolveGitWorkspaceRoot",
+      "requireGitWorkspaceRoot",
+      "--show-toplevel",
+      "Refusing to create UES runtime artifacts",
+    ],
+  },
+  {
+    file: "lib/planning-speed-policy.mjs",
+    minBytes: 1_500,
+    startsWith: "function bounded",
+    required: [
+      "planningRuntimeBudget",
+      "shouldSoftSteerArchitect",
+      "absoluteHardTimeoutMs",
+      "activityExtensionMs",
+      "activityWindowMs",
+      "150_000",
+      "maxExplorationTools",
+    ],
+  },
+  {
+    file: "lib/leaf-runtime-optimizer.mjs",
+    minBytes: 2_000,
+    startsWith: "import ",
+    required: [
+      "leafTaskPolicy",
+      "failureDelta",
+      "rootExecutionProfile",
+      "FAILURE_SIGNAL",
+      "Declared write files",
+    ],
+  },
+  {
+    file: "lib/pi-child-invocation.mjs",
+    minBytes: 1_500,
+    startsWith: "import ",
+    required: [
+      "looksLikePiCliEntrypoint",
+      "resolvePiChildInvocation",
+      "@earendil-works/pi-coding-agent",
+      "resolveManagedPiCommand",
+      "resolveWindowsCommand",
+      "host-pi-cli",
+      "managed-pi",
+    ],
+  },
   {
     file: "lib/pi-rpc-pool.mjs",
     minBytes: 8_000,
     startsWith: "import ",
-    required: ["class RpcWorker", "steerActive", "abortActive", "abortTransport", "activeAbort", "uesRpcPhase", "stopAll"],
+    required: [
+      "class RpcWorker",
+      "steerActive",
+      "abortActive",
+      "abortTransport",
+      "activeAbort",
+      "uesRpcPhase",
+      "stopAll",
+      "createAdaptiveDeadline",
+      "absoluteHardTimeoutMs",
+      "partialAssistantMessage",
+      "rich timeout error before transport teardown",
+      "settled.catch(() => {})",
+    ],
+  },
+  {
+    file: "lib/worktree-sandbox.mjs",
+    minBytes: 8_000,
+    startsWith: "import ",
+    required: [
+      "pruneOrphanTaskSandboxes",
+      "taskSandboxOwnerRoot",
+      "ownerPid",
+      "owner-alive",
+      "legacyMinAgeMs",
+      "ownedMinAgeMs",
+      "reclaimOwnerPid",
+      "protected-active",
+      "sidecarsRemoved",
+      "detached-owner-alive",
+      "detached-remove-failed",
+      "detached: true",
+      "sourceGitPathspecs",
+      "isUesRuntimeArtifactPath",
+      "intentToAddSourceFiles",
+      "--exclude-standard",
+      "processAlive",
+    ],
   },
   {
     file: "lib/workspace-fingerprint.mjs",
     minBytes: 3_000,
     startsWith: "import ",
-    required: ["runtimeWorkspaceFingerprint", "runtimeWorkspaceSnapshot", "changedFiles", "cacheable", "untrackedContentDigest", "untracked-total-too-large"],
+    required: [
+      "runtimeWorkspaceFingerprint",
+      "runtimeWorkspaceSnapshot",
+      "changedFiles",
+      "cacheable",
+      "untrackedContentDigest",
+      "untracked-total-too-large",
+      "UES_RUNTIME_DIRS",
+      "runtime-artifacts.mjs",
+    ],
   },
   {
     file: "lib/skill-compiler.mjs",
@@ -166,11 +404,28 @@ const CONTRACTS = [
     startsWith: "import ",
     required: ["diagnoseCode", "lspProviderStatus", "publishDiagnostics"],
   },
+  {
+    file: "lib/execution-contract.mjs",
+    minBytes: 8_000,
+    startsWith: "import ",
+    required: [
+      "captureInheritedDirtyState",
+      "detectInheritedDirtyViolations",
+      "explicitlyAuthorizedInheritedDirtyPaths",
+      "taskExplicitlyAllowsLocalEnvWrite",
+      "enforcePhaseGates",
+      "executionContractPrompt",
+      "buildFinalVerdictMatrix",
+      "phaseArtifactPayloads",
+      "crossToolTempPathRisk",
+      "cross-tool-posix-temp-path",
+    ],
+  },
   {
     file: "lib/completion-auditor.mjs",
     minBytes: 2_500,
     startsWith: "function text",
-    required: ["auditCompletion", "fresh-behavioral-receipt-missing", "missing-report-section"],
+    required: ["auditCompletion", "fresh-behavioral-receipt-missing", "missing-report-section", "benignFailureSection", "outOfScopeGapOnly", "verification-reports-out-of-scope-gap"],
   },
   {
     file: "lib/document-ingestion.mjs",
@@ -203,6 +458,218 @@ const CONTRACTS = [
     required: ["hash anchored edits fail closed", "completion auditor rejects narrative PASS", "verified memory snapshots ignore retrieval/touch noise", "MCP health only recommends reconnect"],
   },
 
+  {
+    file: "lib/task-policy.mjs",
+    minBytes: 8_000,
+    startsWith: "const SENSITIVE_DOMAIN",
+    required: [
+      "CONCRETE_DIAGNOSIS",
+      "readOnlyTask",
+      "READ_ONLY_MODE",
+      "MUTATION_INTENT",
+      "requireBehavioralReceipt",
+      "diagnosisEvidence",
+      "word such as \"fix\" must not force",
+      "shouldRunDedicatedDiagnosis",
+      "deterministicReadOnlyGitCommands",
+      "automaticUesAdmission",
+      "automaticUesContinuation",
+      "AUTO_ACTIVE_CONTINUATION",
+      "AUTO_INFORMATIONAL_ONLY",
+      'route: "native"',
+      'policy.risk === "high" ? "guarded" : "auto"',
+      "high-risk-engineering-task",
+    ],
+  },
+  {
+    file: "global-config/agents/executor.md",
+    minBytes: 2_000,
+    startsWith: "---",
+    required: [
+      "Quality-preserving bounded-exploration policy",
+      "do not inventory the repository",
+      "spend the remaining effort on fresh verification",
+    ],
+  },
+  {
+    file: "global-config/agents/plan-checker.md",
+    minBytes: 1_500,
+    startsWith: "---",
+    required: [
+      "Efficiency contract",
+      "do not independently rescan the whole repository",
+      "return PASS/REVISE immediately",
+    ],
+  },
+  {
+    file: "lib/task-graph.mjs",
+    minBytes: 7_000,
+    startsWith: "import ",
+    required: [
+      "normalizePlanForValidation",
+      "acceptanceCriteria",
+      "verificationChecks",
+      "riskNotes",
+      "Unknown prose in a risk field is never downgraded",
+    ],
+  },
+  {
+    file: "global-config/agents/architect.md",
+    minBytes: 2_000,
+    startsWith: "---",
+    required: [
+      "UES_PLAN_JSON:",
+      "\"acceptance\"",
+      "\"verification\"",
+      "\"riskNotes\"",
+      "low`, `medium`, `high`, `critical",
+      "Efficiency contract for DEEP/long-horizon work",
+      "Stop repository exploration as soon as every planned task",
+      "machine-first planning mode",
+      "before the prose sections",
+    ],
+  },
+  {
+    file: "lib/turbo-fast-path.mjs",
+    minBytes: 1_000,
+    startsWith: "const FAST_ROLES",
+    required: [
+      "turboFastPathDecision",
+      "turboFastTimeoutBudget",
+      "single-model-deterministic-first",
+      "failClosed",
+      "verifierOnDemand",
+    ],
+  },
+  {
+    file: "lib/service-manager.mjs",
+    minBytes: 8_000,
+    startsWith: "import ",
+    required: [
+      "startService",
+      "waitForService",
+      "serviceStatus",
+      "serviceLogs",
+      "stopService",
+      "restartService",
+      "stopAllServices",
+      "looksLikeLongRunningServiceCommand",
+      "terminateProcessTree",
+      'kind: "service-log"',
+    ],
+  },
+  {
+    file: "test/runtime-artifacts.test.mjs",
+    minBytes: 1_000,
+    startsWith: 'import test from "node:test"',
+    required: [
+      "V15.9 runtime artifact filter excludes UES state but preserves real source files",
+      "V15.9 runtime filter normalizes Windows separators",
+      "apps/mobile/package.json",
+      ".ues-traces/ues-run.jsonl",
+    ],
+  },
+  {
+    file: "test/activity-deadline.test.mjs",
+    minBytes: 1_500,
+    startsWith: 'import test from "node:test"',
+    required: [
+      "V15.10 active work extends the initial deadline but never beyond the absolute cap",
+      "V15.10 stale activity does not extend a hard deadline",
+      "absolute-hard-timeout",
+    ],
+  },
+  {
+    file: "test/plan-salvage.test.mjs",
+    minBytes: 2_400,
+    startsWith: 'import test from "node:test"',
+    required: [
+      "V15.10 plan salvage accepts a marked valid graph",
+      "V15.10 plan salvage recovers a complete graph before a transport timeout note",
+      "V15.10 plan salvage can recover a fenced valid graph when the marker is missing",
+      "V15.10 plan salvage never upgrades an invalid graph into a valid one",
+    ],
+  },
+  {
+    file: "test/adaptive-context-budget-v15.test.mjs",
+    minBytes: 1_500,
+    startsWith: 'import test from "node:test"',
+    required: [
+      "V15.10 high-risk planner context is role-bounded while execution keeps full evidence",
+      "V15.10 planner recovery may expand toward the ceiling without changing the executor ceiling",
+      "high-risk-planner-role-bounded",
+      "high-risk-execution-preserves-base-budget",
+    ],
+  },
+  {
+    file: "test/planning-speed-policy.test.mjs",
+    minBytes: 1_500,
+    startsWith: 'import test from "node:test"',
+    required: [
+      "V15.10 architect planning has an activity-aware ceiling and tighter recovery",
+      "V15.10 architect soft-steers before idle watchdog or runaway exploration",
+      "V15.10 plan-checker uses bounded activity extension and shorter recovery",
+    ],
+  },
+  {
+    file: "test/worktree-sandbox.test.mjs",
+    minBytes: 8_000,
+    startsWith: 'import test from "node:test"',
+    required: [
+      "V15.6 orphan sandbox cleanup removes dead-owner worktrees but preserves live ownership",
+      "V15.7 cleanup reclaims ended same-process sandboxes but protects active ones",
+      "V15.7 cleanup removes orphan metadata sidecars for missing sandboxes",
+      "V15.8 cleanup removes detached physical sandbox folders with valid metadata",
+      "V15.9 sandbox integration ignores UES trace artifacts but keeps real source changes",
+      "pruneOrphanTaskSandboxes",
+      "ownerPid",
+    ],
+  },
+  {
+    file: "test/leaf-runtime-optimizer.test.mjs",
+    minBytes: 2_000,
+    startsWith: 'import test from "node:test"',
+    required: [
+      "V15.5 low-risk single-file leaf becomes FAST inside a DEEP root",
+      "V15.5 high-risk database leaf never downshifts from DEEP",
+      "V15.5 failure delta keeps error evidence and drops unrelated chatter",
+      "leafTaskPolicy",
+      "failureDelta",
+    ],
+  },
+  {
+    file: "test/v15-runtime.test.mjs",
+    minBytes: 3_000,
+    startsWith: 'import assert from "node:assert/strict"',
+    required: [
+      "V15 managed service starts, proves readiness, captures evidence and stops",
+      "V15 deterministic controller admission and service tool are wired into Pi",
+      "V15.4 ACP host never reuses an ACP entrypoint as the Pi child",
+      "V15.2 quick discount benchmark remains FAST and Turbo-eligible",
+      "normalizePlanForValidation",
+      "STRICT JSON CONTRACT",
+      "deepExplorationContract",
+      "UES DEEP bounded exploration",
+      "UES_EVAL_DIRECT_TELEMETRY",
+      "ues_controller_direct",
+      "controller progress",
+      "controllerValid=",
+    ],
+  },
+
+  {
+    file: "scripts/eval-pi.mjs",
+    minBytes: 15_000,
+    startsWith: "import ",
+    required: [
+      "ues_controller_progress",
+      "ues_controller_direct",
+      "agentRun.stdout, agentRun.stderr",
+      "onStderr: (chunk) => consumeControllerProgress",
+      "controllerValid=",
+      "UES_EVAL_DIRECT_TELEMETRY",
+    ],
+  },
   {
     file: "lib/affected-tests.mjs",
     minBytes: 7_500,