opencode-agent-skill 7.7.0 → 9.0.0

package/docs/DETERMINISTIC-TOOLS.md

@@ -1,6 +1,6 @@
 # Deterministic evidence and execution tools
 
-UES 6 uses dependency-light Node helpers for work that should not rely on a model guessing or remembering it.
+UES 8 uses dependency-light Node helpers for work that should not rely on a model guessing or remembering it.
 
 ## Repository evidence
 
@@ -54,16 +54,20 @@ Validates plan shape/dependencies/cycles and computes topological and safe waves
 ```cmd
 ocskill work init <slug> . --goal "..."
 ocskill work plan <slug> PLAN.json .
-ocskill work approve-plan <slug> . --evidence "..."
+ocskill work gate-receipt <slug> plan . --verifier ues-plan-checker --evidence "PASS" --out .ues-work/<slug>/reports/plan-receipt.json
+ocskill work approve-plan <slug> . --evidence "PASS" --receipt-file .ues-work/<slug>/reports/plan-receipt.json
 ocskill work start <slug> T1 .
-ocskill work complete <slug> T1 . --evidence "..."
+ocskill work verify-command <slug> T1 . --run-id <run-id> -- npm test
+ocskill work complete <slug> T1 . --run-id <run-id> --evidence "verified"
 ocskill work fail <slug> T1 . --reason "..."
-ocskill work verify-integration <slug> . --verdict PASS --evidence "..."
-ocskill work finalize <slug> . --evidence "..."
+ocskill work gate-receipt <slug> integration . --verifier ues-integration-verifier --verdict PASS --evidence "PASS" --out .ues-work/<slug>/reports/integration-receipt.json
+ocskill work verify-integration <slug> . --verdict PASS --evidence "PASS" --receipt-file .ues-work/<slug>/reports/integration-receipt.json
+ocskill work finalize <slug> . --evidence "final acceptance verified"
+ocskill work events <slug> . --limit 100
 ocskill work resume <slug> .
 ```
 
-State/evidence writes use a per-item lock and atomic replacement.
+State/evidence writes use a per-item lock and atomic replacement. `EVENTS.jsonl` is append-only runtime evidence. Long/high-risk tasks require successful receipts for the active run and current workspace fingerprint.
 
 ## Context pack
 
@@ -71,11 +75,24 @@ State/evidence writes use a per-item lock and atomic replacement.
 ocskill context-pack <slug> <task> .
 ```
 
-Returns only the task, bounded spec, dependency reports, decisions, blockers and current task state required for a fresh executor.
+Returns the task, bounded spec, dependency reports, decisions, blockers, current task state and Context Manifest v3: declared files, import neighbors, likely tests, nearby instructions, Git-changed files, task-term relevance, symbol hits, centered excerpts and promoted lessons.
 
 ## Runtime dispatch on OpenCode V2
 
-The managed plugin exposes `ues.dispatch_task`, which combines `work start`, context pack, model policy and a fresh OpenCode executor session.
+The managed plugin exposes `ues.dispatch_task`, which combines `work start`, context pack, model policy and a fresh OpenCode executor session with heartbeat, bounded wait and interrupt-on-timeout. It also exposes runtime cancellation/recovery helpers when the OpenCode session API supports them.
+
+## Sandboxes and learning
+
+```cmd
+ocskill sandbox create <slug> <task-id> .
+ocskill sandbox integrate <worktree-path> .
+ocskill sandbox list .
+ocskill learn analyze . --eval-dir .ues-evals
+ocskill learn accept <proposal-id> .
+ocskill learn promote <proposal-id> . --baseline 0.50 --candidate 0.75 --samples 4
+```
+
+Sandbox integration refuses overlap with dirty root files. Shadow-required learning proposals are not retrieved until a measured benchmark improvement is recorded.
 
 ## Constraints
 

package/docs/ENGINEERING-DESIGN.md

@@ -1,6 +1,6 @@
 # UES engineering design
 
-UES 6 evolves the project from an engineering workflow harness into a **long-horizon execution engine** designed to reduce context pressure on coding models.
+UES 8 evolves the project from an engineering workflow harness into a **long-horizon execution engine** designed to reduce context pressure on coding models.
 
 The selected model remains the selected model. UES improves orchestration, evidence, task boundaries, state persistence and verification; it does not claim model equivalence.
 
@@ -48,11 +48,13 @@ The catalog remains 39 skills. UES prefers a small active skill set and loads de
 
 ### Hard gates, not reminders
 
-Three V6 gates are machine-enforced:
+V8 machine-enforces the important boundaries:
 
-1. imported plans are not executable until plan-checker PASS is recorded;
-2. durable mutations are serialized with a per-work-item lock and atomic replacement;
-3. finalization requires integration PASS and an unchanged workspace fingerprint.
+1. long/high-risk plans are not executable until a structured plan-verification receipt matches the current plan hash;
+2. long/high-risk task completion requires a successful verification receipt for the active run and the current workspace fingerprint;
+3. durable state/evidence mutations are serialized with a per-work-item lock and atomic replacement;
+4. integration PASS for strict work requires a structured integration receipt bound to the current workspace fingerprint;
+5. finalization requires PASS and rejects any later workspace change.
 
 These checks do not depend on a model remembering an instruction.
 
@@ -64,6 +66,7 @@ These checks do not depend on a model remembering an instruction.
   PLAN.json
   STATE.json
   EVIDENCE.json
+  EVENTS.jsonl
   tasks/
   reports/
 ```
@@ -79,13 +82,15 @@ On OpenCode V2, the managed plugin exposes `ues.dispatch_task`.
 It:
 
 1. calls the state engine to start one ready task;
-2. obtains the bounded context pack;
+2. obtains the bounded Context Manifest v3 pack;
 3. resolves the configured model tier for the executor attempt;
-4. creates a fresh OpenCode session;
-5. switches to `ues-executor`;
-6. optionally switches to the configured model;
-7. prompts exactly the approved task;
-8. waits and returns child-session context.
+4. optionally isolates a concurrent writer in a Git worktree;
+5. creates a fresh OpenCode session rooted at the execution directory;
+6. binds the session ID to the durable lease;
+7. switches to `ues-executor` and optionally to the configured model;
+8. prompts exactly the approved task;
+9. heartbeats while waiting under a bounded timeout;
+10. interrupts the child on timeout/cancel and returns a bounded report.
 
 The parent is still responsible for inspecting the child diff and recording completion/failure evidence.
 
@@ -131,7 +136,9 @@ UES separates:
 1. **static skill contract** — 34 scenarios covering the 39-skill catalog;
 2. **V2 router precision matrix** — 120 required-route/negative-guard cases;
 3. **standard live benchmark** — 20 executable hidden-graded tasks;
-4. **long-horizon benchmark** — 5 tasks, including one 15-source-file integration workload.
+4. **long-horizon benchmark** — 5 tasks, including one 15-source-file integration workload;
+5. **polyglot benchmark** — 8 tasks spanning Python, Java, .NET, Next.js, React Native, SQL migration, monorepo boundaries and generated contracts;
+6. **matrix runner** — baseline vs UES across multiple suites/trials with coverage validation.
 
 For long-suite UES mode, final behavior alone is insufficient. A PASS also requires a completed durable work item with plan approval, at least two tasks, attempted/completed task records, integration PASS and finalization evidence.
 
@@ -173,4 +180,15 @@ The V2 plugin probes actual session capabilities before dispatch rather than tre
 
 Hermes is deliberately adapter-only. UES can detect Hermes and generate a bounded task handoff, but does not embed Hermes' runtime, memory, scheduler or gateway into core.
 
-The local Control Center is observational. It reads durable artifacts and eval summaries; it does not bypass plan, verification, safety or finalization gates.
+## V8 intelligence and reliability additions
+
+V8 adds six control loops around the V7 runtime:
+
+1. **hard evidence binding** — structured plan/integration receipts plus current-workspace task receipts;
+2. **bounded executor lifecycle** — session binding, timeout interrupt, cancellation and task-scoped recovery;
+3. **event sourcing for observability** — append-only `EVENTS.jsonl` alongside snapshot state;
+4. **context manifest v3** — Git-change awareness, symbol hits, TF-IDF-style ranking and centered excerpts;
+5. **safe parallel integration** — isolated worktrees with dirty-root conflict refusal and UES-only branch cleanup;
+6. **benchmark-gated learning** — clustered proposals require explicit acceptance and measured shadow improvement before retrieval.
+
+The local Control Center remains a safe local observer/controller. It can inspect receipts/events and request stale recovery, but it does not bypass plan, verification, safety or finalization gates and does not directly own OpenCode sessions.

package/docs/EVALS.md

@@ -1,6 +1,6 @@
 # UES evaluations
 
-UES 6 separates catalog correctness, routing precision, benchmark integrity, final behavior and long-horizon orchestration.
+UES 8 separates catalog correctness, routing precision, benchmark integrity, final behavior, long-horizon orchestration and cross-stack coverage.
 
 ## 1. Static skill-routing contract
 
@@ -44,11 +44,22 @@ npm run evals:long:validate
 
 The same broken-fixture rule applies.
 
-## 5. Live baseline vs UES
+## 5. Polyglot suite integrity
+
+The polyglot suite contains **8 tasks** covering Python, Java, .NET, Next.js, React Native, SQL migration, monorepo boundaries and generated contract discipline.
+
+```bash
+npm run evals:polyglot:validate
+```
+
+The hidden graders must reject the intentionally broken fixture before the suite is considered valid.
+
+## 6. Live baseline vs UES
 
 ```bash
 ocskill eval-live --model provider/model --trials 3
 ocskill eval-live --suite long --model provider/model --trials 3
+ocskill eval-live --suite polyglot --model provider/model --trials 3
 ```
 
 Each task runs as:
@@ -66,15 +77,26 @@ For `--suite long`, a UES-mode result is PASS only if:
 2. hidden behavior grader passes;
 3. at least one `.ues-work/<slug>/` item is valid;
 4. the plan contains at least two tasks;
-5. plan approval status is `passed`;
+5. plan approval status is `passed` and contains a structured plan-verification receipt for the current plan hash;
 6. every planned task has an attempt and ends `completed`;
-7. integration verification is `PASS`;
-8. integration and finalization evidence exist;
-9. work item status is `completed`.
+7. every task is backed by a successful verification receipt;
+8. integration verification is `PASS` and contains a structured integration-verification receipt for the verified workspace fingerprint;
+9. integration and finalization evidence exist;
+10. work item status is `completed`.
 
 Therefore a model that directly patches all files in its main context but bypasses the long-task engine is not counted as a successful UES long-horizon run.
 
-## Authentication isolation
+## 7. Benchmark matrix
+
+Run all three behavioral suites in baseline and UES mode:
+
+```bash
+npm run evals:matrix -- --model provider/model --trials 3
+```
+
+The matrix verifies that the expected number of baseline and UES runs was produced before summarizing pass-rate delta. Use `--long-only`, `--standard-only`, `--polyglot-only`, or `--without-polyglot` to narrow the matrix.
+
+## 8. Authentication isolation
 
 Default mode:
 
@@ -92,7 +114,7 @@ ocskill eval-live --model provider/model --auth current --trials 3
 
 `current` copies only the current auth file, not the user's global UES configuration.
 
-## Telemetry
+## 9. Telemetry
 
 Results may include:
 
@@ -108,7 +130,7 @@ Results may include:
 
 No hidden chain-of-thought is collected.
 
-## Report aggregation
+## 10. Report aggregation
 
 ```bash
 ocskill eval-report .ues-evals
@@ -119,7 +141,7 @@ Compare the same model, variant, prompt, fixture, grader and environment. Report
 A benchmark result is evidence only for the measured workload. UES does not claim to turn one base model into another.
 
 
-## V7 live-run observability and evidence gate
+## V8 live-run observability and evidence gate
 
 Live runs accept:
 
@@ -131,6 +153,6 @@ Live runs accept:
 
 The harness prints a start line and heartbeat for an active model run. Hard timeout and idle timeout are recorded separately. Ctrl+C aborts the active OpenCode process tree and sets exit code 130 after the current result is recorded.
 
-V7 long-suite UES mode additionally requires **receipt-backed verification for every planned task**. A narrative completion entry is still preserved for backwards compatibility, but it does not satisfy the V7 long benchmark unless at least one successful structured verification receipt is bound to that task.
+V8 long-suite UES mode requires **receipt-backed verification for every planned task**, a structured plan receipt bound to the current plan hash, and a structured integration receipt bound to the verified workspace fingerprint. Strict task completion additionally rejects a successful command receipt if the workspace changed after that receipt.
 
-This intentionally raises the benchmark bar: final code correctness + durable orchestration + machine-observable verification are all required.
+This intentionally raises the benchmark bar: final code correctness + durable orchestration + current machine-observable verification are all required.

package/docs/NPM-PUBLISH.md

@@ -17,7 +17,7 @@ opencode-agent-skill
 npm run ci
 ```
 
-V7.7 CI includes syntax validation, resource validation, static skill routing, the 120-case V2 router matrix, standard and long hidden-grader integrity checks, unit/integration tests, package dry-run, and an isolated packed global-install smoke.
+V9 CI includes syntax validation, resource validation, static skill routing, the 120-case V2 router matrix, standard/long/polyglot hidden-grader integrity checks, unit/integration tests, package dry-run, packed global-install smoke, and a plain global-install compatibility smoke.
 
 ## Manual release-like test
 
@@ -27,7 +27,7 @@ Use:
 
 ```cmd
 npm pack
-npm install -g .\opencode-agent-skill-7.7.0.tgz --allow-scripts=opencode-agent-skill
+npm install -g .\opencode-agent-skill-9.0.0.tgz --allow-scripts=opencode-agent-skill
 ocskill status
 ocskill doctor
 ```
@@ -47,19 +47,19 @@ After publication verify:
 
 ```cmd
 npm view opencode-agent-skill versions --json
-npm view opencode-agent-skill@7.7.0 version
+npm view opencode-agent-skill@9.0.0 version
 npm dist-tag ls opencode-agent-skill
 ```
 
 The expected release tag is:
 
 ```text
-latest: 7.7.0
+latest: 9.0.0
 ```
 
 ## GitHub Actions publishing
 
-The repository's publish workflow is release-ready for token-based publishing and provenance. It runs the same package validation before `npm publish`.
+The repository's publish workflow is OIDC/provenance-ready and runs the same package validation before `npm publish`.
 
 For stronger long-term supply-chain security, configure npm Trusted Publishing for:
 
@@ -71,7 +71,7 @@ Workflow: publish.yml
 
 Then the GitHub-hosted workflow can authenticate through OIDC instead of a long-lived npm publish token. npm Trusted Publishing requires the corresponding publisher relationship to be configured on npm; repository code alone cannot create that account-side trust relationship.
 
-Until that npm-side setup is complete, keep a valid publish credential configured as `NPM_TOKEN`.
+Until the npm-side Trusted Publisher relationship is configured, the workflow can fall back to a valid `NPM_TOKEN`. After OIDC publishing is verified, remove long-lived publish-token access where practical.
 
 ## Release checklist
 

package/docs/OPENCODE-COMPAT.md

@@ -1,6 +1,6 @@
 # OpenCode compatibility
 
-UES 6 ships one npm package for OpenCode 1.x and 2.x, while only enabling V2-native runtime features when V2 is detected.
+UES 8 ships one npm package for OpenCode 1.x and 2.x, while only enabling V2-native runtime features when V2 is detected.
 
 ## Detection
 
@@ -44,11 +44,12 @@ The plugin provides:
 
 - prompt-admission skill routing
 - long-task context guardrails
-- permission safety evaluation
-- read-only durable-state/task-graph/context-pack tools
-- `ues.dispatch_task` fresh executor runtime
+- permission safety evaluation when that hook exists
+- durable-state/task-graph/context-pack tools
+- `ues.dispatch_task` bounded fresh executor runtime
+- `ues.cancel_task` and `ues.recover_task` when session interruption is supported
 
-`ues.dispatch_task` uses V2 session APIs to create a fresh session, select `ues-executor`, optionally switch to the configured model tier, prompt one approved task and wait for completion.
+`ues.dispatch_task` uses V2 session APIs to create a fresh session rooted at the selected execution directory, bind its session ID to the task lease, select `ues-executor`, optionally switch model tier, prompt one approved task, heartbeat while waiting, and interrupt on timeout. Concurrent writing tasks can be isolated in Git worktrees.
 
 ## Router control
 
@@ -92,18 +93,20 @@ Only UES-managed resources are rewritten/removed. Unrelated user plugins/resourc
 - https://opencode.ai/v2/docs/skills
 
 
-## V7 capability probing
+## V8 capability probing
 
-Version detection remains useful for install-time compatibility, but V7 runtime dispatch does not assume that a major version proves the availability of every session API.
+Version detection remains useful for install-time compatibility, but V8 runtime dispatch does not assume that a major version proves the availability of every session API.
 
 The managed V2 plugin probes for:
 
 - session creation
 - prompting
 - waiting
+- interruption
 - context retrieval
 - agent switching
 - model switching
 - session hooks
+- permission hooks
 
-`ues.capabilities` exposes the observed surface. `ues.dispatch_task` fails closed when the minimum fresh-dispatch capability set is unavailable instead of attempting a partially supported execution path.
+`ues.capabilities` exposes the observed surface. Fresh dispatch fails closed when the minimum create/prompt/wait/interrupt/context/switch-agent surface is unavailable. Optional context/prompt/permission hooks degrade safely instead of preventing the plugin from loading.

package/docs/TRACE-SCHEMA.md

@@ -75,7 +75,7 @@ Keep constant:
 Compare observable success, regressions, elapsed time, tool behavior and cost rather than narrative confidence.
 
 
-## V7 runtime fields
+## V8 runtime and evidence fields
 
 Each live result may additionally contain:
 
@@ -86,7 +86,7 @@ Each live result may additionally contain:
 - configured heartbeat/hard/idle timeout values
 - long-suite receipt coverage inside orchestration inspection
 
-Long-task `EVIDENCE.json` schema 3 may contain a `receipts` array. Receipt fields include:
+Long-task `EVIDENCE.json` schema 3 may contain `receipts` and `gateReceipts` arrays. Command receipt fields include:
 
 ```json
 {
@@ -107,3 +107,16 @@ Long-task `EVIDENCE.json` schema 3 may contain a `receipts` array. Receipt field
 ```
 
 Full stdout/stderr are not stored in receipts; hashes provide binding without persisting potentially sensitive logs.
+
+
+### Structured gate receipts
+
+Strict plan/integration gates use receipt schema version 1. A plan receipt includes the exact `planHash`; an integration receipt includes the exact `workspaceFingerprint`. Both include verifier identity, optional session/run IDs, evidence text and an optional report hash.
+
+### Runtime event journal
+
+Each long work item may include `EVENTS.jsonl`. Every line is an independent JSON event with schema version, UUID, event type, timestamp and task/work metadata. It records operational events only and never hidden chain-of-thought.
+
+### Benchmark matrix summary
+
+`scripts/eval-matrix.mjs` writes a matrix summary containing selected suites/model/trials, expected runs per mode, actual baseline/UES counts, coverage completeness and aggregated pass-rate statistics.

package/docs/V8-INTELLIGENCE-RELIABILITY.md

@@ -0,0 +1,206 @@
+# UES 8.0 Intelligence & Reliability
+
+UES 8.0 focuses on runtime reliability, stronger evidence gates, context quality, safe parallelism and measurable learning. It does not change the underlying model; it improves how engineering work is selected, executed, verified, recovered and evaluated.
+
+## 1. Hard evidence gates
+
+Long-horizon and high-risk work uses strict evidence policy.
+
+Plan approval requires a structured `plan-verification` receipt bound to the current `PLAN.json` hash:
+
+```bash
+ocskill work gate-receipt checkout plan .   --verifier ues-plan-checker   --evidence "plan checker PASS"   --out .ues-work/checkout/reports/plan-receipt.json
+
+ocskill work approve-plan checkout .   --evidence "plan checker PASS"   --receipt-file .ues-work/checkout/reports/plan-receipt.json
+```
+
+Task completion requires a successful verification receipt for the active `runId`. In strict mode, the receipt's `workspaceAfter` must also equal the current workspace fingerprint.
+
+Integration PASS requires an `integration-verification` receipt bound to the current workspace fingerprint. `finalize` still rejects any later workspace change.
+
+## 2. Durable runtime journal
+
+Each long work item now includes:
+
+```text
+.ues-work/<slug>/
+  SPEC.md
+  PLAN.json
+  STATE.json
+  EVIDENCE.json
+  EVENTS.jsonl
+  tasks/
+  reports/
+```
+
+`EVENTS.jsonl` is append-only runtime evidence for:
+
+- work initialization;
+- plan import and approval;
+- task start/session binding/heartbeat;
+- verification receipts;
+- failure and stale recovery;
+- task completion;
+- integration verification;
+- finalization.
+
+Read recent events with:
+
+```bash
+ocskill work events <slug> . --limit 100
+```
+
+## 3. Bounded executor lifecycle
+
+The OpenCode V2 dispatcher probes capabilities instead of assuming them from a version string.
+
+A fresh executor has:
+
+- a durable `runId`;
+- attached OpenCode session ID;
+- heartbeat and lease expiry;
+- bounded runtime;
+- `session.interrupt` on timeout/cancel;
+- task-scoped stale recovery;
+- process-tree cancellation for external eval processes.
+
+On Unix, timed-out external process trees receive SIGTERM followed by SIGKILL after a bounded grace period if necessary. Windows uses `taskkill /T /F`.
+
+The V2 plugin exposes task cancellation/recovery tools when the runtime supports session interruption.
+
+## 4. Context manifest v3
+
+Context selection now combines:
+
+- declared task files;
+- local imports and reverse importers;
+- likely related tests;
+- nearby repository instructions/manifests;
+- current Git-changed files;
+- multilingual task terms;
+- symbol hits;
+- TF-IDF-style content relevance;
+- centered source excerpts around matched terms;
+- accepted benchmark-validated lessons.
+
+The context remains bounded by a per-task budget rather than dumping the whole repository.
+
+## 5. Safer parallel writes
+
+Safe-wave analysis still serializes declared read/write conflicts.
+
+Writer tasks are isolated in Git worktrees by default when the root checkout is clean (unless isolation is explicitly disabled). This keeps the first writer off the canonical root as well as later concurrent writers. Integration:
+
+- captures tracked and untracked sandbox changes;
+- rejects overlap with dirty files in the root checkout;
+- applies the patch to the root only after explicit integration;
+- cleans temporary UES worktree branches;
+- refuses to delete non-UES branches.
+
+Manual flow:
+
+```bash
+ocskill sandbox create <slug> <task-id> .
+ocskill sandbox integrate <worktree-path> .
+ocskill sandbox list .
+```
+
+## 6. Learning v2
+
+Evaluation failures are clustered into recurring patterns and candidate rules.
+
+```bash
+ocskill learn analyze . --eval-dir .ues-evals
+ocskill learn accept <proposal-id> .
+```
+
+Acceptance alone does not make a shadow-required lesson active. Promotion additionally requires measured benchmark improvement:
+
+```bash
+ocskill learn promote <proposal-id> . --report .ues-evals/matrix/matrix-summary-<timestamp>.json
+```
+
+Promotion reads the benchmark matrix artifact itself, verifies complete/equal baseline-vs-UES coverage, hashes the artifact, and refuses caller-supplied pass-rate claims. Only promoted lessons are eligible for future context retrieval.
+
+## 7. Benchmark matrix
+
+Run standard, long-horizon and polyglot baseline-vs-UES evaluations:
+
+```bash
+npm run evals:matrix -- --model provider/model --trials 3
+```
+
+The matrix checks expected baseline/UES coverage before producing a summary. Options include:
+
+```text
+--long-only
+--standard-only
+--polyglot-only
+--without-polyglot
+```
+
+The polyglot suite adds eight tasks covering Python authorization, Java money validation, .NET authorization, Next.js API error handling, React Native platform logic, safe SQL migration, monorepo dependency boundaries and generated-contract discipline.
+
+Benchmark results are evidence for the measured tasks only. They are not evidence that UES converts one model into another model.
+
+## 8. Control Center
+
+```bash
+ocskill dashboard . --serve --port 4177
+```
+
+V8 adds:
+
+- runtime event visibility;
+- verification-receipt inspection;
+- stale-task recovery action;
+- existing work/learning/eval summaries.
+
+Executor cancellation remains a runtime operation because a standalone dashboard server cannot safely interrupt an OpenCode session it does not own.
+
+## 9. Package migration
+
+The npm package remains:
+
+```text
+opencode-agent-skill
+```
+
+Users already on 7.7.0 can update normally:
+
+```bash
+ocskill update
+```
+
+The installer now writes:
+
+```text
+<!-- managed-by: opencode-agent-skill -->
+```
+
+It still recognizes the former scoped package owner and marker, then migrates them during re-sync.
+
+## 10. Release and supply-chain checks
+
+V8 adds:
+
+- CodeQL workflow;
+- dependency-review workflow;
+- Dependabot for GitHub Actions and npm;
+- package/tag version consistency guard;
+- tag-only npm publish workflow;
+- OIDC-only npm Trusted Publishing permissions (no long-lived NODE_AUTH_TOKEN);
+- fail-closed tag/version guard;
+- exact plain global-install compatibility smoke in addition to packed-install smoke.
+
+Trusted Publishing still requires the npm account-side trust relationship to be configured for `laivannha0202/opencode-agent-skill-` and `publish.yml`.
+
+## Validation before release
+
+Run:
+
+```bash
+npm run ci
+```
+
+Then run a real benchmark matrix with the target model. Merge/publish only after local CI is green and benchmark output has been inspected.