opencode-ship 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to `opencode-ship` are recorded here.
 
+## 0.8.0 — Ready gate (parallel GPT Standards/Spec + verifier + CI on one HEAD)
+
+`opencode-ship@0.8.0` ships the Ready gate contract required by issue #23 (Task 9 in approved plan). The final review is the merge-base-to-HEAD review package; the GPT Standards and Spec reviewers inspect it in parallel; the verifier executes the canonical consumer verification command independently; and the gate refuses any record that is not on the current HEAD. Build cannot self-record both the final review and the verifier — the boundary is enforced by the same-runId check on the runId separate from Build's.
+
+### Verification
+
+- `npm run verify` exits `0` with 317 tests across 34 suites on the v0.8 HEAD.
+
+### Added
+
+- **Final review package + axes.** `src/installer/final-review.js` exposes `buildFinalReviewPackage` (merge-base-to-HEAD), `emitStandardsVerdict` and `emitSpecVerdict` (parallel, separate findings with `standardsKind` / `specKind` discriminators), `shouldRecordFinalReview` (pass only when both axes are non-blocking AND HEAD is current), `isReviewStale` (Ready gate staleness check), `READY_GATE_STATES` (the documented transition set: REVIEW_IN_PROGRESS, STANDARDS_PENDING, SPEC_PENDING, BOTH_PENDING, BOTH_PASSED, BLOCKING_FINDINGS, READY).
+- **Ready gate.** `src/installer/ready-gate.js` exposes `recordVerifierOutput` (binds the verifier output to the current HEAD; verifier runs in its own runId separate from Build's), `isVerifierStale` (same staleness rule as final review), `buildCannotSelfRecord` (refuses when the final review and the verifier share a runId — Build cannot self-verify), `isReady` (only true when Standards + Spec verdicts are non-blocking AND the verifier exited 0 AND CI is "pass" — all on the same HEAD), `recordReady` (stamps the Ready state on the consumer's HEAD).
+
 ## 0.7.0 — M3 task loop contract
 
 `opencode-ship@0.7.0` ships the M3 task loop contract required by issue #22 (Task 7 in approved plan). The run store persists task state under `.git/opencode-ship/runs/<taskId>/`; the task brief extractor surfaces only the active task plus the plan header; the task reviewer emits separate Spec and Quality verdicts; the build-side commit ownership returns true only when the immutable review package is sealed and the plan hash still matches; the three-round breaker routes a failed third round back to the GPT planning role for a revision; the commit binding appends the immutable range to the run ledger; and the compaction context builder emits the short pointer set the chat hook injects when the context overflows. No plan body, no report body, and no commit diffs ever enter the chat.

package/README.md

@@ -2,7 +2,7 @@
 
 > npm-distributed OpenCode installer and delivery plugin: a single command materialises the lifecycle plugin, reviewer/verifier agents, and skills into any consumer repository, with a recoverable lock and never silently overwrites managed files.
 >
-> **Status:** v0.7.0 compact-safe M3 task loop. The installer is a `pnpm dlx opencode-ship@latest <cmd>` workflow. Five idempotent CLI commands manage a managed-file lock, a transactional promoter, and a compiled ESM plugin that registers the canonical nine `delivery_*` tools. Every command now accepts `--profile <name>` (`core` default, `engineering` opt-in) and resolves the active profile through one documented precedence chain (CLI > ship.config > lock > default). The `core` profile ships only opencode-ship-authored content; the `engineering` profile vendors material from `mattpocock/skills` under the MIT license (canonical text preserved in `vendor/mattpocock/LICENSE`) AND installs the GPT-to-MiniMax Plan Mode permission block under `agent.plan.permission` so consumers can spin up a Plan Mode sub-agent without hand-editing the opencode.json. The M3 task loop contract (run store + task brief + Spec/Quality verdicts + 3-round breaker + commit binding + compaction context) is now implemented end-to-end. v0.7 ships the M3 task loop contract required by issue #22 and approved plan `f85bae931d9eed7763e2f6f4dc68e5fad71bdd38c8a667fc9ffe78b5290200be` (`Viktorxyz/opencode-ship#16`); the actual implementer and reviewer sub-agents are runtime pieces that depend on the consumer's OpenCode configuration.
+> **Status:** v0.8.0 Ready gate (parallel GPT Standards/Spec + verifier + CI on one HEAD). The installer is a `pnpm dlx opencode-ship@latest <cmd>` workflow. Five idempotent CLI commands manage a managed-file lock, a transactional promoter, and a compiled ESM plugin that registers the canonical nine `delivery_*` tools. Every command now accepts `--profile <name>` (`core` default, `engineering` opt-in) and resolves the active profile through one documented precedence chain (CLI > ship.config > lock > default). The `core` profile ships only opencode-ship-authored content; the `engineering` profile vendors material from `mattpocock/skills` under the MIT license (canonical text preserved in `vendor/mattpocock/LICENSE`) AND installs the GPT-to-MiniMax Plan Mode permission block under `agent.plan.permission` so consumers can spin up a Plan Mode sub-agent without hand-editing the opencode.json. The M3 task loop contract (run store + task brief + Spec/Quality verdicts + 3-round breaker + commit binding + compaction context) is now implemented end-to-end. The Ready gate contract (parallel GPT Standards/Spec + verifier + CI on one HEAD; Build cannot self-record) is now implemented end-to-end. v0.8 ships the Ready gate contract required by issue #23 and approved plan `f85bae931d9eed7763e2f6f4dc68e5fad71bdd38c8a667fc9ffe78b5290200be` (`Viktorxyz/opencode-ship#16`).
 
 ---
 
@@ -111,7 +111,7 @@ Existing consumers of `opencode-delivery@0.1.x` (commit-pinned shim) can run `pn
 
 ## Development
 
-`npm run verify` runs `format:check`, `lint`, `typecheck`, `build`, and the auto-discovered test suite. The tests cover the installer CLI, the lock and root-config planners, the catalog validator, the schema validator, agents, the packed-artifact smoke check, the transaction-recovery contract, the profile-resolution precedence chain, the catalog profile filter, the order-preserving root-config merge, the engineering↔core transition, the durable plan artifact, the Plan Mode permission integration, the M3 task loop contract (run store + task brief + Spec/Quality verdicts + 3-round breaker + commit binding + compaction context). v0.7 ships with 302 tests across 34 suites on the approved plan hash `f85bae931d9eed7763e2f6f4dc68e5fad71bdd38c8a667fc9ffe78b5290200be`.
+`npm run verify` runs `format:check`, `lint`, `typecheck`, `build`, and the auto-discovered test suite. The tests cover the installer CLI, the lock and root-config planners, the catalog validator, the schema validator, agents, the packed-artifact smoke check, the transaction-recovery contract, the profile-resolution precedence chain, the catalog profile filter, the order-preserving root-config merge, the engineering↔core transition, the durable plan artifact, the Plan Mode permission integration, the M3 task loop contract (run store + task brief + Spec/Quality verdicts + 3-round breaker + commit binding + compaction context), and the Ready gate (parallel GPT Standards/Spec + verifier + CI on one HEAD; Build cannot self-record). v0.8 ships with 317 tests across 34 suites on the approved plan hash `f85bae931d9eed7763e2f6f4dc68e5fad71bdd38c8a667fc9ffe78b5290200be`.
 
 ```
 npm ci
@@ -124,7 +124,7 @@ The shipped artifact is built by esbuild (`scripts/build.mjs`); self-contained `
 ## Status and licensing
 
 - **License:** MIT. See `LICENSE`.
-- **Versioning:** SemVer. v0.2.0 is the first npm-distributed release. v0.3.0 is the installer foundation with core-only defaults. v0.4.0 adds the profile-aware installer foundation (`--profile` flag, lock schema v2, profile precedence) that issue #18 requires. v0.5.0 ships the engineering profile content (triage + grill-with-docs SKILL.md placeholders) required by issue #20. v0.6.0 ships the durable plan artifact + Plan Mode permission integration required by issue #21. v0.7.0 ships the M3 task loop contract (run store, task brief, Spec/Quality verdicts, 3-round breaker, commit binding, compaction context) required by issue #22.
+- **Versioning:** SemVer. v0.2.0 is the first npm-distributed release. v0.3.0 is the installer foundation with core-only defaults. v0.4.0 adds the profile-aware installer foundation (`--profile` flag, lock schema v2, profile precedence) that issue #18 requires. v0.5.0 ships the engineering profile content (triage + grill-with-docs SKILL.md placeholders) required by issue #20. v0.6.0 ships the durable plan artifact + Plan Mode permission integration required by issue #21. v0.7.0 ships the M3 task loop contract (run store, task brief, Spec/Quality verdicts, 3-round breaker, commit binding, compaction context) required by issue #22. v0.8.0 ships the Ready gate contract (parallel GPT Standards/Spec + verifier + CI on one HEAD; Build cannot self-record) required by issue #23.
 - **Compatibility:** the bundled plugin targets `@opencode-ai/plugin >= 1.15.5 < 2` and OpenCode `>= 1.15.5`.
 
 ## FAQ

package/THIRD_PARTY_NOTICES.md

@@ -1,11 +1,11 @@
 # Third-Party Notices
 
-`opencode-ship@0.7.0` ships the profile-aware installer foundation
+`opencode-ship@0.8.0` ships the profile-aware installer foundation
 (`core` and `engineering` profiles), the durable plan artifact
-with Plan Mode permission integration, and the M3 task loop
-contract. The `core` profile ships only opencode-ship-authored
-content (two delivery agents, two workflow skills). The
-`engineering` profile vendors material from
+with Plan Mode permission integration, the M3 task loop
+contract, and the Ready gate. The `core` profile ships only
+opencode-ship-authored content (two delivery agents, two
+workflow skills). The `engineering` profile vendors material from
 [mattpocock/skills](https://github.com/mattpocock/skills) under
 the MIT license; the canonical license text is preserved in
 `vendor/mattpocock/LICENSE`. The current package version ships

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// opencode-ship CLI v0.7.0
+// opencode-ship CLI v0.8.0
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -687,7 +687,7 @@ function resolvePackageRoot(startUrl) {
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "node:fs";
 import { dirname as dirname2, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var PACKAGE_VERSION = "0.7.0";
+var PACKAGE_VERSION = "0.8.0";
 var TEMPLATE_SET = `v${PACKAGE_VERSION}`;
 
 // src/installer/catalog.js
@@ -2286,7 +2286,7 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profil
     manager: {
       schemaVersion: CURRENT_LOCK_SCHEMA,
       name: "opencode-ship",
-      version: "0.7.0",
+      version: "0.8.0",
       templateSet: TEMPLATE_SET_ID,
       // Newly written locks always carry the resolved profile so
       // future CLI invocations without --profile still resolve to

package/dist/core.js

@@ -1,4 +1,4 @@
-// opencode-ship/core v0.7.0
+// opencode-ship/core v0.8.0
 
 // src/adapter.js
 import { readFile, writeFile, mkdir, rename } from "node:fs/promises";

package/dist/plugin.js

@@ -1,4 +1,4 @@
-// opencode-ship v0.7.0
+// opencode-ship v0.8.0
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -14897,7 +14897,7 @@ function flattenShipConfig(ship) {
 import { readFileSync as readFileSync2, existsSync as existsSync6 } from "node:fs";
 import { dirname as dirname5, resolve as resolve11 } from "node:path";
 import { fileURLToPath } from "node:url";
-var PACKAGE_VERSION = "0.7.0";
+var PACKAGE_VERSION = "0.8.0";
 var TEMPLATE_SET = `v${PACKAGE_VERSION}`;
 
 // src/plugin.js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-ship",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "private": false,
   "description": "npm-distributed OpenCode installer that materializes the delivery plugin, reviewer/verifier agents, skills, ship config and lock into any consumer repository.",
   "license": "MIT",