opencode-agent-skill 7.7.0 → 10.0.0

package/global-config/plugins/ues-router/router.js

@@ -11,50 +11,167 @@ const PROCESS_SKILLS = new Set([
   "ues-repo-explorer",
 ])
 
-export function routeSkills(text, maxSkills = 4) {
+const DOMAIN_PATTERNS = [
+  ["react-native", /(react native|expo|android|ios|gradle|xcode|metro)/],
+  ["nextjs", /(next\.js|nextjs|app router|server component)/],
+  ["react", /(\breact\b|\bhook\b|useeffect|usestate|\bcomponent\b)/],
+  ["fastapi", /(fastapi|pydantic|uvicorn)/],
+  ["django", /(django|django rest|drf)/],
+  ["python", /(python|pytest|pip|poetry|pyproject)/],
+  ["nestjs", /(nestjs|nest\.js)/],
+  ["nodejs", /(node\.js|nodejs|express|npm|pnpm|yarn)/],
+  ["dotnet", /(asp\.net|\.net|dotnet|nuget|c#)/],
+  ["java-spring", /(spring boot|spring framework|maven|gradle java|\bjava\b)/],
+  ["flutter", /(flutter|dart)/],
+  ["database", /(database|migration|sql|query|index|transaction|schema changes?|cơ sở dữ liệu|truy vấn|chỉ mục|giao dịch|migrate dữ liệu)/],
+  ["auth-security", /(auth|authorization|authentication|permission|role|tenant|idor|token|session|xác thực|phân quyền|quyền|vai trò)/],
+  ["payment", /(payment|checkout|webhook|refund|idempotenc|thanh toán|hoàn tiền)/],
+  ["api-contract", /(api contract|openapi|response schema|request schema|breaking api|public api|hợp đồng api|api công khai)/],
+  ["devops", /(docker|github actions|ci\/cd|pipeline|deploy|kubernetes|container|triển khai|đường ống ci)/],
+  ["performance", /(performance|slow|latency|memory leak|n\+1|bundle size|hiệu năng|chậm|rò rỉ bộ nhớ)/],
+  ["accessibility", /(accessibility|accessible|a11y|screen reader|keyboard navigation|aria|focus management|focus handling)/],
+  ["file-upload", /(upload|file upload|multipart|object storage)/],
+  ["ecommerce", /(ecommerce|marketplace|inventory|cart|catalog|order)/],
+]
+
+const STACK_TO_DOMAIN = new Map([
+  ["react-native", "react-native"],
+  ["react", "react"],
+  ["nextjs", "nextjs"],
+  ["nestjs", "nestjs"],
+  ["express", "nodejs"],
+  ["fastify", "nodejs"],
+  ["node", "nodejs"],
+  ["python", "python"],
+  ["django", "django"],
+  ["java-maven", "java-spring"],
+  ["java-gradle", "java-spring"],
+  ["kotlin-gradle", "java-spring"],
+  ["dotnet", "dotnet"],
+  ["flutter", "flutter"],
+])
+
+export function classifyIntent(text, facts = {}) {
   const value = String(text || "").toLowerCase()
-  const limit = Number.isInteger(maxSkills) ? Math.max(1, Math.min(maxSkills, 6)) : 4
-  const routed = []
-  const risky = /(migration|schema|database|sql|auth|permission|security|payment|webhook|public api|contract|dependency|deploy|ci|production|rollback)/
-  const nonTrivial = value.length > 220 || risky.test(value) || /(implement|feature|refactor|fix|debug|investigate|review|audit|bug|regression|failing|failure|error|exception|broken)/.test(value)
+  const domains = []
+  for (const [domain, pattern] of DOMAIN_PATTERNS) {
+    if (pattern.test(value)) add(domains, domain)
+  }
 
-  if (nonTrivial) add(routed, "ues-engineering-orchestrator")
-  const longHorizon = value.length > 700 || /(large task|big task|long[- ]running|multi[- ]file|cross[- ]module|whole (?:repo|repository|project)|entire (?:repo|repository|project)|full refactor|refactor all|migrate all|resume this work)/.test(value)
-  if (longHorizon) {
-    add(routed, "ues-engineering-orchestrator")
-    add(routed, "ues-long-task-state")
-    add(routed, "ues-task-planner")
+  const repoStacks = [...new Set(
+    (facts.repoStacks || facts.stacks || [])
+      .map((item) => String(item || "").toLowerCase())
+      .filter(Boolean),
+  )]
+  const explicitFramework = domains.some((domain) => [
+    "react-native", "nextjs", "react", "fastapi", "django", "python", "nestjs",
+    "nodejs", "dotnet", "java-spring", "flutter",
+  ].includes(domain))
+  if (!explicitFramework) {
+    for (const stack of repoStacks) add(domains, STACK_TO_DOMAIN.get(stack))
+  }
+
+  const actions = []
+  if (/(\bfix\b|\bbug\b|crash|regression|failing|failure|error|exception|broken|\bdebug\b|sửa lỗi|lỗi|không chạy|bị hỏng|điều tra lỗi)/.test(value)) add(actions, "debug")
+  if (/(implement|feature|add|build|create|triển khai tính năng|thêm|xây dựng)/.test(value)) add(actions, "implement")
+  if (/(review|audit|kiểm tra code|đánh giá)/.test(value)) add(actions, "review")
+  if (/(investigate|analy[sz]e|profile|optimi[sz]e|điều tra|phân tích|tối ưu)/.test(value)) add(actions, "investigate")
+  if (/(refactor|cleanup|restructure|refactor toàn bộ)/.test(value)) add(actions, "refactor")
+  if (/(latest|current docs|documentation|release notes|version compatibility|dependency|package version|api changed|tài liệu mới nhất|phiên bản mới|tương thích phiên bản|package mới)/.test(value)) add(actions, "research")
+
+  const risky = /(migration|schema|database|sql|auth|permission|security|payment|webhook|public api|contract|dependency|deploy|ci|production|rollback|cơ sở dữ liệu|phân quyền|xác thực|bảo mật|thanh toán|triển khai|phụ thuộc)/.test(value)
+  const longHorizon = value.length > 700 || /(large task|big task|long[- ]running|multi[- ]file|cross[- ]module|whole (?:repo|repository|project)|entire (?:repo|repository|project)|full refactor|refactor all|migrate all|resume this work|toàn bộ (?:repo|repository|dự án)|nhiều file|nhiều module|refactor toàn bộ|tiếp tục công việc)/.test(value)
+  const nonTrivial = value.length > 220 || risky || actions.length > 0
+
+  const feedbackDomains = [...new Set((facts.feedbackDomains || []).filter((item) => domains.includes(item)))]
+  const confidence = Math.min(1, 0.35 + domains.length * 0.08 + actions.length * 0.08 + (repoStacks.length ? 0.08 : 0) + (feedbackDomains.length ? 0.08 : 0))
+
+  return {
+    schemaVersion: 1,
+    actions,
+    domains,
+    repoStacks,
+    feedbackDomains,
+    nonTrivial,
+    risk: risky ? "high" : nonTrivial ? "medium" : "low",
+    scope: longHorizon ? "long-horizon" : nonTrivial ? "standard" : "inline",
+    confidence: Number(confidence.toFixed(2)),
   }
-  if (/(\bfix\b|\bbug\b|crash|regression|failing|failure|error|exception|broken|\bdebug\b)/.test(value)) add(routed, "ues-bug-diagnosis")
-  if (/(latest|current docs|documentation|release notes|version compatibility|dependency|package version|api changed)/.test(value)) add(routed, "ues-research-verification")
+}
 
+function addDomainSkills(routed, value, intent) {
   if (/(react native|expo|android|ios|gradle|xcode|metro)/.test(value)) add(routed, "ues-react-native-engineering")
   else if (/(next\.js|nextjs|app router|server component)/.test(value)) add(routed, "ues-nextjs-engineering")
   else if (/(\breact\b|\bhook\b|useeffect|usestate|\bcomponent\b)/.test(value)) add(routed, "ues-react-engineering")
+  else {
+    for (const domain of intent.domains) {
+      if (domain === "react-native") add(routed, "ues-react-native-engineering")
+      else if (domain === "nextjs") add(routed, "ues-nextjs-engineering")
+      else if (domain === "react") add(routed, "ues-react-engineering")
+    }
+  }
+
+  if (/(fastapi|pydantic|uvicorn)/.test(value)) add(routed, "ues-fastapi-engineering")
+  else if (/(django|django rest|drf)/.test(value)) add(routed, "ues-django-engineering")
+  else if (/(python|pytest|pip|poetry|pyproject)/.test(value)) add(routed, "ues-python-engineering")
+  else {
+    if (intent.domains.includes("fastapi")) add(routed, "ues-fastapi-engineering")
+    else if (intent.domains.includes("django")) add(routed, "ues-django-engineering")
+    else if (intent.domains.includes("python")) add(routed, "ues-python-engineering")
+  }
+
+  if (/(nestjs|nest\.js)/.test(value)) add(routed, "ues-nestjs-engineering")
+  else if (/(node\.js|nodejs|express|npm|pnpm|yarn)/.test(value)) add(routed, "ues-nodejs-engineering")
+  else {
+    if (intent.domains.includes("nestjs")) add(routed, "ues-nestjs-engineering")
+    else if (intent.domains.includes("nodejs")) add(routed, "ues-nodejs-engineering")
+  }
+
+  if (/(asp\.net|\.net|dotnet|nuget|c#)/.test(value) || intent.domains.includes("dotnet")) add(routed, "ues-dotnet-engineering")
+  if (/(spring boot|spring framework|maven|gradle java|\bjava\b)/.test(value) || intent.domains.includes("java-spring")) add(routed, "ues-java-spring-engineering")
+  if (/(flutter|dart)/.test(value) || intent.domains.includes("flutter")) add(routed, "ues-flutter-engineering")
 
-  if (/(database|migration|sql|query|index|transaction|schema changes?)/.test(value)) {
+  if (intent.domains.includes("database")) {
     add(routed, "ues-database-engineering")
     add(routed, "ues-change-impact-analysis")
   }
-  if (/(auth|authorization|authentication|permission|role|tenant|idor|token|session)/.test(value)) {
+  if (intent.domains.includes("auth-security")) {
     add(routed, "ues-auth-security")
     add(routed, "ues-change-impact-analysis")
   }
-  if (/(payment|checkout|webhook|refund|idempotenc)/.test(value)) {
+  if (intent.domains.includes("payment")) {
     add(routed, "ues-payment-engineering")
     add(routed, "ues-change-impact-analysis")
   }
-  if (/(api contract|openapi|response schema|request schema|breaking api|public api)/.test(value)) {
+  if (intent.domains.includes("api-contract")) {
     add(routed, "ues-api-contract")
     add(routed, "ues-change-impact-analysis")
   }
-  if (/(docker|github actions|ci\/cd|pipeline|deploy|kubernetes|container)/.test(value)) add(routed, "ues-devops-engineering")
-  if (/(performance|slow|latency|memory leak|n\+1|bundle size)/.test(value)) add(routed, "ues-performance-engineering")
-  if (/(accessibility|accessible|a11y|screen reader|keyboard navigation|aria|focus management|focus handling)/.test(value)) add(routed, "ues-accessibility")
-  if (/(upload|file upload|multipart|object storage)/.test(value)) add(routed, "ues-file-upload-engineering")
-  if (/(ecommerce|marketplace|inventory|cart|catalog|order)/.test(value)) add(routed, "ues-ecommerce-engineering")
+  if (intent.domains.includes("devops")) add(routed, "ues-devops-engineering")
+  if (intent.domains.includes("performance")) add(routed, "ues-performance-engineering")
+  if (intent.domains.includes("accessibility")) add(routed, "ues-accessibility")
+  if (intent.domains.includes("file-upload")) add(routed, "ues-file-upload-engineering")
+  if (intent.domains.includes("ecommerce")) add(routed, "ues-ecommerce-engineering")
+}
+
+export function routeSkills(text, maxSkills = 4, facts = {}) {
+  const value = String(text || "").toLowerCase()
+  const limit = Number.isInteger(maxSkills) ? Math.max(1, Math.min(maxSkills, 6)) : 4
+  const routed = []
+  const intent = classifyIntent(value, facts)
+
+  if (intent.nonTrivial) add(routed, "ues-engineering-orchestrator")
+  if (intent.scope === "long-horizon") {
+    add(routed, "ues-engineering-orchestrator")
+    add(routed, "ues-long-task-state")
+    add(routed, "ues-task-planner")
+  }
+  if (intent.actions.includes("debug")) add(routed, "ues-bug-diagnosis")
+  if (intent.actions.includes("research")) add(routed, "ues-research-verification")
+
+  addDomainSkills(routed, value, intent)
 
-  if (routed.length === 0 && /(code|repository|repo|project|function|class|endpoint|test)/.test(value)) {
+  if (routed.length === 0 && /(code|repository|repo|project|function|class|endpoint|test|dự án|hàm|lớp|kiểm thử)/.test(value)) {
     add(routed, "ues-repo-explorer")
   }
 
@@ -72,3 +189,38 @@ export function routeSkills(text, maxSkills = 4) {
 
   return routed.slice(0, limit)
 }
+
+export function routeSkillsForPolicy(text, policy = {}, maxSkills = 4, facts = {}) {
+  const limit = Number.isInteger(maxSkills) ? Math.max(1, Math.min(maxSkills, 6)) : 4
+  const routed = routeSkills(text, 6, facts)
+  const fast =
+    policy?.executionProfile === "fast" &&
+    policy?.risk !== "high" &&
+    policy?.mode !== "long-horizon"
+
+  if (!fast) return routed.slice(0, limit)
+
+  const eligible = routed.filter((id) =>
+    ![
+      "ues-engineering-orchestrator",
+      "ues-change-impact-analysis",
+      "ues-task-planner",
+      "ues-long-task-state",
+    ].includes(id),
+  )
+  const selected = [
+    ...eligible.filter((id) => !PROCESS_SKILLS.has(id)),
+    ...eligible.filter((id) => PROCESS_SKILLS.has(id)),
+  ]
+
+  const value = String(text || "").toLowerCase()
+  if (/(review|audit|kiểm tra code|đánh giá)/.test(value)) add(selected, "ues-code-review")
+  if (/(verify|verification|test|tests|kiểm thử|xác minh)/.test(value)) add(selected, "ues-test-verification")
+
+  if (selected.length === 0 && /(code|repository|repo|project|function|class|endpoint|hàm|lớp|dự án)/.test(value)) {
+    add(selected, "ues-repo-explorer")
+  }
+
+  return selected.slice(0, limit)
+}
+

package/global-config/plugins/ues-router/runtime-guard.js

@@ -0,0 +1,265 @@
+import { createHash } from "node:crypto"
+
+const EXPLORATION_TOOL = /(?:^|[._-])(read|grep|glob|repo[-_.]?graph|semantic[-_.]?search|aci[-_.]?search)(?:$|[._-])/i
+const VERIFY_OR_WRITE_TOOL = /(?:^|[._-])(edit|write|patch|bash|shell|verify|test|apply)(?:$|[._-])/i
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical)
+  if (!value || typeof value !== "object") return value
+  return Object.fromEntries(
+    Object.keys(value).sort().map((key) => [key, canonical(value[key])]),
+  )
+}
+
+export function stableRuntimeHash(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(canonical(value))
+  return createHash("sha256").update(text || "").digest("hex")
+}
+
+export function isExplorationTool(tool) {
+  return EXPLORATION_TOOL.test(String(tool || ""))
+}
+
+export function budgetToolResult(tool, result, options = {}) {
+  const name = String(tool || "")
+  const aggressive = /grep|glob|repo[-_.]?graph|semantic[-_.]?search/i.test(name)
+  const maxChars = Math.max(2_000, Number(options.maxChars || (aggressive ? 12_000 : 24_000)))
+  const maxLines = Math.max(40, Number(options.maxLines || (aggressive ? 160 : 360)))
+
+  if (!aggressive && !/read/i.test(name)) return result
+
+  const original = typeof result === "string" ? result : String(result?.output || "")
+  const lines = original.split(/\r?\n/)
+  if (original.length <= maxChars && lines.length <= maxLines) return result
+
+  const digest = stableRuntimeHash(original)
+  const headLineCount = Math.max(1, Math.floor(maxLines * 0.7))
+  const tailLineCount = Math.max(1, maxLines - headLineCount)
+  let bounded = [
+    ...lines.slice(0, headLineCount),
+    `...[UES tool output truncated: ${lines.length} lines / ${original.length} chars, sha256=${digest.slice(0, 16)}]...`,
+    ...lines.slice(-tailLineCount),
+  ].join("\n")
+
+  if (bounded.length > maxChars) {
+    const marker = `\n...[UES char budget applied; sha256=${digest.slice(0, 16)}]...\n`
+    const room = Math.max(0, maxChars - marker.length)
+    const head = Math.floor(room * 0.7)
+    bounded = bounded.slice(0, head) + marker + bounded.slice(-(room - head))
+  }
+
+  if (typeof result === "string") return bounded
+  return {
+    ...result,
+    output: bounded,
+    metadata: {
+      ...(result?.metadata || {}),
+      uesTruncated: true,
+      uesOriginalChars: original.length,
+      uesOriginalLines: lines.length,
+      uesOutputDigest: digest,
+    },
+  }
+}
+
+export function classifyProviderFailure(error = {}) {
+  const status = Number(error?.status ?? error?.cause?.status)
+  const type = String(error?.type || error?.code || "")
+  const message = String(error?.message || error || "")
+  const value = `${type} ${message}`.toLowerCase()
+
+  if (status === 401 || status === 403 || /auth|unauthori[sz]ed|invalid api key|credential/.test(value)) return "AUTH"
+  if (/context.{0,20}(large|length|window|overflow)|too many tokens|max(?:imum)? context/.test(value)) return "CONTEXT_TOO_LARGE"
+  if (status === 429 || /rate.?limit|too many requests/.test(value)) return "RATE_LIMIT"
+  if (/quota|credit|billing|insufficient balance/.test(value)) return "QUOTA"
+  if (/no token|no output|empty response|empty completion|returned no content|no content|stalled|no-progress/.test(value)) return "NO_TOKEN"
+  if (/timeout|timed out|deadline|abort(?:ed)?/.test(value)) return "TIMEOUT"
+  if (Number.isFinite(status) && status >= 500 && status < 600) return "PROVIDER_5XX"
+  if (/provider|upstream|gateway|service unavailable/.test(value)) return "PROVIDER_5XX"
+  return "OTHER"
+}
+
+export function progressWatchdogDecision(snapshot = {}, now = Date.now(), stallMs = 60_000) {
+  const limit = Math.max(30_000, Math.min(Number(stallMs || 60_000), 5 * 60_000))
+  const lastProgressAt = Number(snapshot.lastProgressAt || 0)
+  const activeToolCalls = Math.max(0, Number(snapshot.activeToolCalls || 0))
+  const idleMs = Math.max(0, Number(now) - lastProgressAt)
+
+  if (activeToolCalls > 0) {
+    return { stalled: false, idleMs, limitMs: limit, reason: "tool-active" }
+  }
+  return {
+    stalled: idleMs >= limit,
+    idleMs,
+    limitMs: limit,
+    reason: idleMs >= limit ? "no-progress" : "within-grace",
+  }
+}
+
+export function providerRecoveryPlan(kind, physicalAttempt = 1, options = {}) {
+  const attempt = Math.max(1, Number(physicalAttempt || 1))
+  const hasEscalationModel = Boolean(options.hasEscalationModel)
+
+  if (kind === "AUTH") return { action: "fail-fast", retry: false, reason: "authentication failure requires user/config repair" }
+  if (kind === "CONTEXT_TOO_LARGE") return { action: "compact-context", retry: false, reason: "reduce/compact context instead of repeating the same request" }
+  if (kind === "QUOTA") {
+    return hasEscalationModel
+      ? { action: "fresh-session-escalated-model", retry: true, reason: "quota exhausted on current provider/model" }
+      : { action: "fail-retryable", retry: false, reason: "quota exhausted and no configured fallback model exists" }
+  }
+
+  if (["NO_TOKEN", "TIMEOUT", "RATE_LIMIT", "PROVIDER_5XX"].includes(kind)) {
+    if (attempt <= 1) {
+      return { action: "fresh-session-same-model", retry: true, reason: "retry transport/provider stall once with fresh session state" }
+    }
+    if (hasEscalationModel) {
+      return { action: "fresh-session-escalated-model", retry: true, reason: "repeated provider failure triggers configured model/provider escalation" }
+    }
+    return { action: "fail-retryable", retry: false, reason: "repeated provider failure without configured fallback" }
+  }
+
+  return { action: "fail-task", retry: false, reason: "non-provider failure should be diagnosed by the task recovery policy" }
+}
+
+function createSessionState(now = Date.now()) {
+  return {
+    signatures: new Map(),
+    lastWorkspaceSignal: null,
+    lastEvidenceKey: null,
+    noProgressCalls: 0,
+    loopBlocked: false,
+    lastProgressAt: now,
+    activeCalls: new Set(),
+    compactionAt: null,
+  }
+}
+
+export function createRuntimeGuard(options = {}) {
+  const duplicateLimit = Math.max(2, Number(options.duplicateLimit || 3))
+  const loopLimit = Math.max(4, Number(options.loopLimit || 6))
+  const sessions = new Map()
+
+  function stateFor(sessionID, at = Date.now()) {
+    const key = String(sessionID || "global")
+    if (!sessions.has(key)) sessions.set(key, createSessionState(at))
+    return sessions.get(key)
+  }
+
+  function resetForWorkspace(state, workspaceSignal) {
+    if (state.lastWorkspaceSignal === null || state.lastWorkspaceSignal === workspaceSignal) return
+    state.signatures.clear()
+    state.noProgressCalls = 0
+    state.loopBlocked = false
+    state.lastEvidenceKey = null
+  }
+
+  return {
+    before(input = {}) {
+      const at = Number(input.now || Date.now())
+      const state = stateFor(input.sessionID, at)
+      const workspaceSignal = String(input.workspaceSignal || "")
+      resetForWorkspace(state, workspaceSignal)
+      state.lastWorkspaceSignal = workspaceSignal
+
+      const tool = String(input.tool || "")
+      if (isExplorationTool(tool)) {
+        const signature = stableRuntimeHash({ tool, input: input.input || {}, cwd: input.cwd || "", workspaceSignal })
+        const seen = state.signatures.get(signature) || { count: 0, lastResultHash: null }
+        seen.count += 1
+        state.signatures.set(signature, seen)
+
+        if (state.loopBlocked) {
+          return {
+            blocked: true,
+            code: "UES_LOOP_DETECTED",
+            message: `UES loop guard blocked repeated exploration after ${state.noProgressCalls} no-progress calls. Choose a deterministic next action: edit the scoped target, run focused verification, inspect a direct caller/failing stack, change hypothesis, or escalate recovery.`,
+            signature,
+          }
+        }
+        if (seen.count > duplicateLimit) {
+          return {
+            blocked: true,
+            code: "UES_DUPLICATE_TOOL",
+            message: `UES duplicate-tool guard blocked ${tool}: equivalent arguments were already executed ${seen.count - 1} times with no workspace change. Use the previous evidence or change the query/scope before retrying.`,
+            signature,
+          }
+        }
+      }
+
+      state.lastProgressAt = at
+      if (input.callID) state.activeCalls.add(String(input.callID))
+      return { blocked: false }
+    },
+
+    after(input = {}) {
+      const at = Number(input.now || Date.now())
+      const state = stateFor(input.sessionID, at)
+      const workspaceSignal = String(input.workspaceSignal || "")
+      const tool = String(input.tool || "")
+      if (input.callID) state.activeCalls.delete(String(input.callID))
+      resetForWorkspace(state, workspaceSignal)
+
+      if (input.status === "completed" && isExplorationTool(tool)) {
+        const resultHash = stableRuntimeHash(input.result || "")
+        const evidenceKey = stableRuntimeHash({ workspaceSignal, resultHash })
+        if (state.lastEvidenceKey === evidenceKey) {
+          state.noProgressCalls += 1
+        } else {
+          state.lastEvidenceKey = evidenceKey
+          state.noProgressCalls = 0
+        }
+        if (state.noProgressCalls >= loopLimit) state.loopBlocked = true
+
+        const signature = stableRuntimeHash({ tool, input: input.input || {}, cwd: input.cwd || "", workspaceSignal })
+        const seen = state.signatures.get(signature)
+        if (seen) seen.lastResultHash = resultHash
+      } else if (
+        input.status === "completed" &&
+        (VERIFY_OR_WRITE_TOOL.test(tool) || state.lastWorkspaceSignal !== workspaceSignal)
+      ) {
+        state.noProgressCalls = 0
+        state.loopBlocked = false
+        state.lastEvidenceKey = null
+        state.signatures.clear()
+      }
+
+      state.lastWorkspaceSignal = workspaceSignal
+      state.lastProgressAt = at
+      return {
+        loopBlocked: state.loopBlocked,
+        noProgressCalls: state.noProgressCalls,
+        lastProgressAt: state.lastProgressAt,
+      }
+    },
+
+    touch(sessionID, at = Date.now()) {
+      const state = stateFor(sessionID, at)
+      state.lastProgressAt = Number(at)
+    },
+
+    compacted(sessionID, at = Date.now()) {
+      const state = stateFor(sessionID, at)
+      state.compactionAt = Number(at)
+      state.lastProgressAt = Number(at)
+      state.signatures.clear()
+      state.noProgressCalls = 0
+      state.loopBlocked = false
+      state.lastEvidenceKey = null
+    },
+
+    snapshot(sessionID) {
+      const state = stateFor(sessionID)
+      return {
+        noProgressCalls: state.noProgressCalls,
+        loopBlocked: state.loopBlocked,
+        lastProgressAt: state.lastProgressAt,
+        activeToolCalls: state.activeCalls.size,
+        compactionAt: state.compactionAt,
+      }
+    },
+
+    clear(sessionID) {
+      sessions.delete(String(sessionID || "global"))
+    },
+  }
+}

package/global-config/skills/engineering-orchestrator/references/long-horizon.md

@@ -12,6 +12,7 @@ When the user explicitly chooses the long-horizon workflow (for example with `/u
   PLAN.json
   STATE.json
   EVIDENCE.json
+  EVENTS.jsonl
   tasks/
   reports/
 ```
@@ -22,9 +23,9 @@ The directory is git-ignored execution state, not hidden reasoning. Store requir
 
 The V6 engine enforces three boundaries:
 
-1. **Plan gate** — `work plan` leaves the item in `awaiting-plan-approval`. `work start` refuses to run until an independent plan checker PASS is recorded with `work approve-plan`.
+1. **Plan gate** — `work plan` leaves the item in `awaiting-plan-approval`. Long/high-risk plans require a structured `plan-verification` receipt bound to the current plan hash before `work approve-plan` succeeds.
 2. **Concurrent state gate** — all mutable `STATE.json` and `EVIDENCE.json` operations use a per-work-item lock plus atomic file replacement, preventing safe-wave executors from losing each other's state.
-3. **Integration gate** — finalization requires a recorded `verify-integration --verdict PASS`. The engine fingerprints the Git workspace at PASS time and rejects finalization if the workspace changes afterward.
+3. **Integration gate** — long/high-risk PASS requires a structured `integration-verification` receipt bound to the current workspace fingerprint. Finalization rejects any later workspace change.
 
 ## Pipeline
 
@@ -32,15 +33,16 @@ The V6 engine enforces three boundaries:
 2. Write observable acceptance criteria into `SPEC.md`.
 3. Initialize state with `ocskill work init`.
 4. Create `PLAN.json` following the plan schema and import it with `ocskill work plan`.
-5. Run `ues-plan-checker`. If it returns PASS, persist that gate with `ocskill work approve-plan`.
+5. Run `ues-plan-checker`. If it returns PASS, create `work gate-receipt <slug> plan` and persist approval with `work approve-plan --receipt-file ...`.
 6. Use `ocskill task-graph` to compute dependency-safe waves.
 7. For each ready task:
    - on OpenCode V2 prefer `ues.dispatch_task`, which performs `work start`, creates a fresh `ues-executor` session, selects the configured attempt-based model tier, prompts it with a bounded context pack and waits for completion;
    - inspect the child diff and verification;
+   - record at least one successful `work verify-command` receipt for long/high-risk work;
    - persist `work complete --evidence ...` or `work fail --reason ...`.
 8. On failure, re-diagnose rather than stacking patches. A later `ues.dispatch_task` attempt can escalate from standard to heavy when configured.
 9. After all tasks complete, run `ues-integration-verifier`.
-10. Persist the verifier's actual result with `ocskill work verify-integration`.
+10. Persist the verifier's actual result with a structured integration receipt plus `ocskill work verify-integration --receipt-file ...`.
 11. Only a recorded PASS with an unchanged workspace can be finalized.
 
 ## Parallelism

package/lib/aci.mjs

@@ -0,0 +1,128 @@
+import { readFile, stat } from "node:fs/promises"
+import path from "node:path"
+import { buildSemanticIndex, querySemanticIndex } from "./semantic-index.mjs"
+
+function safeFull(root, relative) {
+  const base = path.resolve(root)
+  const full = path.resolve(base, relative)
+  if (full !== base && !full.startsWith(base + path.sep)) {
+    throw new Error("path escapes repository root")
+  }
+  return full
+}
+
+export async function aciSearch(root, query, options = {}) {
+  const result = await querySemanticIndex(root, query, {
+    limit: options.limit ?? 20,
+    rebuild: options.rebuild === true,
+  })
+  return {
+    ...result,
+    contract: {
+      evidenceOnly: true,
+      note: "Results are deterministic syntax-aware lexical evidence, not a claim of semantic correctness.",
+    },
+  }
+}
+
+export async function aciReferences(root, symbol, options = {}) {
+  const name = String(symbol || "").trim()
+  if (!/^[A-Za-z_$][A-Za-z0-9_$.-]*$/.test(name)) {
+    throw new Error("reference symbol must be a concrete identifier")
+  }
+  const built = await buildSemanticIndex(root, { rebuild: options.rebuild === true })
+  const results = []
+  for (const [file, entry] of Object.entries(built.index.files)) {
+    const exact = Number(entry.identifiers?.[name] || 0)
+    const folded = exact || Object.entries(entry.identifiers || {}).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1] || 0
+    const definitions = (entry.symbols || []).filter((item) => String(item.name).toLowerCase() === name.toLowerCase())
+    if (!folded && !definitions.length) continue
+    results.push({
+      path: file,
+      references: Number(folded || 0),
+      definitions: definitions.slice(0, 12),
+      evidence: definitions.length ? "definition+lexical-reference" : "lexical-reference",
+    })
+  }
+  results.sort((a, b) => (b.definitions.length - a.definitions.length) || b.references - a.references || a.path.localeCompare(b.path))
+  return {
+    schemaVersion: 1,
+    symbol: name,
+    evidenceLevel: "syntax-aware-lexical",
+    results: results.slice(0, Math.max(1, Math.min(Number(options.limit || 40), 200))),
+    stats: built.stats,
+  }
+}
+
+export async function aciView(root, relative, options = {}) {
+  root = path.resolve(root)
+  const full = safeFull(root, relative)
+  const info = await stat(full).catch(() => null)
+  if (!info?.isFile()) throw new Error("file does not exist: " + relative)
+  const maxBytes = Math.max(4 * 1024, Math.min(Number(options.maxBytes || 256 * 1024), 1024 * 1024))
+  if (info.size > maxBytes) throw new Error("file exceeds bounded viewer limit; request a smaller generated artifact or use repository-native tooling")
+  const source = await readFile(full, "utf8")
+  if (source.includes("\0")) throw new Error("binary file is not supported by bounded viewer")
+  const lines = source.split(/\r?\n/)
+  const center = Math.max(1, Number(options.line || 1))
+  const count = Math.max(1, Math.min(Number(options.lines || 120), 240))
+  const start = Math.max(1, Math.min(
+    Number(options.startLine || 0) || (center - Math.floor(count / 3)),
+    Math.max(1, lines.length),
+  ))
+  const end = Math.min(lines.length, start + count - 1)
+  const width = String(end).length
+  return {
+    schemaVersion: 1,
+    path: path.relative(root, full).replaceAll("\\", "/"),
+    startLine: start,
+    endLine: end,
+    totalLines: lines.length,
+    truncated: start > 1 || end < lines.length,
+    text: lines.slice(start - 1, end)
+      .map((line, index) => String(start + index).padStart(width, " ") + " | " + line)
+      .join("\n"),
+  }
+}
+
+export async function aciTextSearch(root, query, options = {}) {
+  const value = String(query || "").trim()
+  if (value.length < 2) throw new Error("search query must contain at least two characters")
+  const candidateLimit = Math.max(1, Math.min(Number(options.candidateLimit || 500), 5000))
+  const resultLimit = Math.max(1, Math.min(Number(options.limit || 80), 200))
+  const semantic = await querySemanticIndex(root, value, { limit: Math.min(candidateLimit, 100) })
+  const built = await buildSemanticIndex(root)
+  const allIndexed = Object.entries(built.index.files)
+    .filter(([, entry]) => !entry?.skipped)
+    .map(([file]) => file)
+  const candidates = [...new Set([
+    ...semantic.results.map((item) => item.path),
+    ...allIndexed,
+  ])].slice(0, candidateLimit)
+  const matches = []
+  const needle = options.caseSensitive ? value : value.toLowerCase()
+  for (const file of candidates) {
+    const full = safeFull(root, file)
+    const source = await readFile(full, "utf8").catch(() => "")
+    if (!source) continue
+    const lines = source.split(/\r?\n/)
+    for (let index = 0; index < lines.length; index += 1) {
+      const haystack = options.caseSensitive ? lines[index] : lines[index].toLowerCase()
+      if (!haystack.includes(needle)) continue
+      matches.push({ path: file, line: index + 1, preview: lines[index].trim().slice(0, 300) })
+      if (matches.length >= resultLimit) break
+    }
+    if (matches.length >= resultLimit) break
+  }
+  return {
+    schemaVersion: 1,
+    query: value,
+    evidenceLevel: "exact-text",
+    matches,
+    candidatesScanned: candidates.length,
+    candidatePool: allIndexed.length,
+    candidateTruncated: candidates.length < allIndexed.length,
+    resultsTruncated: matches.length >= resultLimit,
+    semanticStats: built.stats,
+  }
+}