opencode-ship 1.1.1 → 1.1.2-rc.2

package/dist/plugin.js

@@ -1,4 +1,4 @@
-// opencode-ship v1.1.1
+// opencode-ship v1.1.2-rc.2
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -12428,8 +12428,8 @@ function tool(input) {
 tool.schema = external_exports;
 
 // src/plugin.js
-import { resolve as resolve14 } from "node:path";
-import { readFile as readFile12 } from "node:fs/promises";
+import { resolve as resolve21 } from "node:path";
+import { readFile as readFile19 } from "node:fs/promises";
 
 // src/adapter.js
 import { readFile, writeFile, mkdir, rename } from "node:fs/promises";
@@ -12706,7 +12706,7 @@ function validateGhArgv(argv) {
 
 // src/drivers/gh-cli.js
 function defaultRunner(cwd, env) {
-  return (args) => new Promise((resolve15, reject2) => {
+  return (args) => new Promise((resolve22, reject2) => {
     const proc = spawn("gh", args, {
       cwd,
       env,
@@ -12718,7 +12718,7 @@ function defaultRunner(cwd, env) {
     proc.stdout.on("data", (d) => stdout += d.toString());
     proc.stderr.on("data", (d) => stderr += d.toString());
     proc.on("error", reject2);
-    proc.on("close", (status) => resolve15({ status: status ?? -1, stdout, stderr }));
+    proc.on("close", (status) => resolve22({ status: status ?? -1, stdout, stderr }));
   });
 }
 function viewFields() {
@@ -15392,9 +15392,9 @@ function createRunStartTool(deps) {
   };
 }
 
-// src/tools/ship-task-report.js
-import { mkdir as mkdir8 } from "node:fs/promises";
-import { createHash as createHash6 } from "node:crypto";
+// src/tools/ship-task-start.js
+import { readFile as readFile9, mkdir as mkdir9 } from "node:fs/promises";
+import { existsSync as existsSync8 } from "node:fs";
 import { join as join10 } from "node:path";
 
 // src/workflow/run-controller.js
@@ -15699,9 +15699,302 @@ async function readRunState(repoRoot, workflowId) {
     events
   };
 }
+function buildCommitTrailers({ workflowId, planHash, taskId, round, reviewHash }) {
+  return [
+    `Opencode-Ship-Workflow: ${workflowId}`,
+    `Opencode-Ship-Plan: ${planHash}`,
+    `Opencode-Ship-Task: ${taskId}`,
+    `Opencode-Ship-Review: ${reviewHash ?? "n/a"}`,
+    `Opencode-Ship-Round: ${round}`
+  ];
+}
 
-// src/tools/ship-task-report.js
+// src/installer/lock.js
+import { readFile as readFile8, writeFile as writeFile8, rename as rename3, mkdir as mkdir8 } from "node:fs/promises";
+import { existsSync as existsSync7 } from "node:fs";
+import { dirname as dirname5, resolve as resolve9 } from "node:path";
+
+// src/installer/hash.js
+import { createHash as createHash6 } from "node:crypto";
+function bytesHash(buffer) {
+  return createHash6("sha256").update(buffer).digest("hex");
+}
+function bytesHashString(text) {
+  return bytesHash(Buffer.from(text, "utf8"));
+}
+
+// src/installer/lock.js
+function lockPath(repoRoot) {
+  return resolve9(repoRoot, ".opencode", "ship.lock.json");
+}
+async function readLock2(repoRoot) {
+  const path = lockPath(repoRoot);
+  if (!existsSync7(path)) return null;
+  try {
+    const raw = await readFile8(path, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function isSetupComplete(lock) {
+  if (!lock || typeof lock !== "object") return false;
+  const manager = lock.manager;
+  if (!manager || typeof manager !== "object") return false;
+  return manager.setupComplete === true;
+}
+
+// src/tools/ship-task-start.js
 var SAFE_ID_RE5 = /^[A-Za-z0-9._-]{1,128}$/;
+function createTaskStartTool(deps) {
+  return async function taskStart(input) {
+    const opId = input.operationId ?? `task-start-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    const taskId = String(input.taskId ?? "");
+    const briefHash = String(input.briefHash ?? "");
+    const sessionID = String(input.sessionID ?? "");
+    const submittedBy = String(input.submittedBy ?? "");
+    if (!workflowId || !SAFE_ID_RE5.test(workflowId)) {
+      return failure("task-start", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!taskId || !SAFE_ID_RE5.test(taskId)) {
+      return failure("task-start", "taskId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!briefHash || !/^[0-9a-f]{64}$/.test(briefHash)) {
+      return failure("task-start", "briefHash required (sha256)", { operationId: opId, retryable: false });
+    }
+    if (!sessionID) {
+      return failure("task-start", "sessionID required (must identify builder session)", { operationId: opId, retryable: false });
+    }
+    if (!submittedBy) {
+      return failure("task-start", "submittedBy required (must identify builder model)", { operationId: opId, retryable: false });
+    }
+    const lock = await readLock2(deps.repoRoot);
+    if (!isSetupComplete(lock)) {
+      return failure("task-start", "setup is not complete; run /setup-ship-workflow first", { operationId: opId, retryable: false });
+    }
+    let models;
+    try {
+      models = resolveModelRoles(deps.config?.workflow, { strict: true });
+    } catch (err) {
+      return failure("task-start", `builder model unresolved: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!submittedBy.startsWith(models.builder)) {
+      return failure("task-start", `submittedBy must be the configured builder model ${models.builder}`, { operationId: opId, retryable: false });
+    }
+    let runState;
+    try {
+      runState = await readRunState(deps.repoRoot, workflowId);
+    } catch (err) {
+      return failure("task-start", `run state unreadable: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!runState) {
+      return failure("task-start", "run not started", { operationId: opId, retryable: false });
+    }
+    try {
+      const commonDir = await resolveGitCommonDir(deps.repoRoot);
+      const dispatchDir = join10(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "dispatch");
+      await mkdir9(dispatchDir, { recursive: true });
+      const record2 = {
+        workflowId,
+        taskId,
+        sessionID,
+        builder: models.builder,
+        briefHash,
+        dispatchedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await publishImmutableJson(join10(dispatchDir, "dispatch.json"), record2);
+      const { state, event } = await appendRunEvent(
+        deps.repoRoot,
+        workflowId,
+        runState,
+        { kind: RUN_EVENT_KINDS.TASK_DISPATCH, data: { taskId, briefHash, sessionID } }
+      );
+      return success2("task-start", { workflowId, taskId, state: state.state, sequence: event.sequence, round: state.round }, { operationId: opId });
+    } catch (err) {
+      return failure("task-start", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/ship-task-commit.js
+import { execFile } from "node:child_process";
+import { mkdir as mkdir10 } from "node:fs/promises";
+import { join as join11 } from "node:path";
+var SAFE_ID_RE6 = /^[A-Za-z0-9._-]{1,128}$/;
+function spawn5(cmd, args, cwd) {
+  return new Promise((resolveP, rejectP) => {
+    execFile(cmd, args, { cwd, shell: false }, (err, stdout, stderr) => {
+      if (err) {
+        const msg = typeof stderr === "string" ? stderr : stderr ? String(stderr) : err.message;
+        return rejectP(new Error(`${cmd} failed: ${msg}`));
+      }
+      resolveP(typeof stdout === "string" ? stdout : String(stdout));
+    });
+  });
+}
+function createTaskCommitTool(deps) {
+  return async function taskCommit(input) {
+    const opId = input.operationId ?? `task-commit-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    const taskId = String(input.taskId ?? "");
+    const expectedHead = String(input.expectedHead ?? "");
+    const commitSha = String(input.commitSha ?? "");
+    const planHash = String(input.planHash ?? "");
+    const reviewHash = String(input.reviewHash ?? "");
+    const round = Number(input.round ?? 1);
+    if (!workflowId || !SAFE_ID_RE6.test(workflowId)) {
+      return failure("task-commit", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!taskId || !SAFE_ID_RE6.test(taskId)) {
+      return failure("task-commit", "taskId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!/^[0-9a-f]{40}$/.test(expectedHead)) {
+      return failure("task-commit", "expectedHead required (40-char commit SHA)", { operationId: opId, retryable: false });
+    }
+    if (!/^[0-9a-f]{40}$/.test(commitSha)) {
+      return failure("task-commit", "commitSha required (40-char commit SHA)", { operationId: opId, retryable: false });
+    }
+    if (!/^[0-9a-f]{64}$/.test(planHash)) {
+      return failure("task-commit", "planHash required (sha256)", { operationId: opId, retryable: false });
+    }
+    if (!reviewHash) {
+      return failure("task-commit", "reviewHash required (from ship_task_review)", { operationId: opId, retryable: false });
+    }
+    const lock = await readLock2(deps.repoRoot);
+    if (!isSetupComplete(lock)) {
+      return failure("task-commit", "setup is not complete; run /setup-ship-workflow first", { operationId: opId, retryable: false });
+    }
+    let runState;
+    try {
+      runState = await readRunState(deps.repoRoot, workflowId);
+    } catch (err) {
+      return failure("task-commit", `run state unreadable: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!runState) {
+      return failure("task-commit", "run not started", { operationId: opId, retryable: false });
+    }
+    if (runState.activeTask !== taskId) {
+      return failure("task-commit", `no active task ${taskId} (active=${runState.activeTask})`, { operationId: opId, retryable: false });
+    }
+    if (runState.state !== "commit-pending") {
+      return failure("task-commit", `task-review must pass before commit; run state=${runState.state}`, { operationId: opId, retryable: false });
+    }
+    try {
+      const actualHead = (await spawn5("git", ["-C", deps.repoRoot, "rev-parse", "HEAD"], deps.repoRoot)).trim();
+      if (actualHead !== expectedHead) {
+        return failure("task-commit", `HEAD drift (expected ${expectedHead.slice(0, 8)}, got ${actualHead.slice(0, 8)})`, { operationId: opId, retryable: false });
+      }
+      const trailers = buildCommitTrailers({ workflowId, planHash, taskId, round, reviewHash });
+      const message = await spawn5("git", ["-C", deps.repoRoot, "log", "-1", "--format=%B", expectedHead], deps.repoRoot);
+      const trailerLines = trailers.map((t) => `  ${t}`).join("\n");
+      if (!message.includes(trailers[0])) {
+        return failure("task-commit", `commit ${expectedHead.slice(0, 8)} missing Opencode-Ship-Workflow trailer`, { operationId: opId, retryable: false });
+      }
+      const commonDir = await resolveGitCommonDir(deps.repoRoot);
+      const commitDir = join11(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "commit");
+      await mkdir10(commitDir, { recursive: true });
+      const record2 = {
+        workflowId,
+        taskId,
+        round,
+        commitSha,
+        planHash,
+        reviewHash,
+        trailers,
+        trailerBlock: trailerLines,
+        committedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await publishImmutableJson(join11(commitDir, "commit.json"), record2);
+      const { state, event } = await appendRunEvent(
+        deps.repoRoot,
+        workflowId,
+        runState,
+        { kind: RUN_EVENT_KINDS.COMMIT, data: { taskId, commitSha } }
+      );
+      return success2("task-commit", { workflowId, taskId, commitSha, state: state.state, sequence: event.sequence }, { operationId: opId });
+    } catch (err) {
+      return failure("task-commit", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/ship-task-complete.js
+import { mkdir as mkdir11 } from "node:fs/promises";
+import { join as join12 } from "node:path";
+var SAFE_ID_RE7 = /^[A-Za-z0-9._-]{1,128}$/;
+function createTaskCompleteTool(deps) {
+  return async function taskComplete(input) {
+    const opId = input.operationId ?? `task-complete-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    const taskId = String(input.taskId ?? "");
+    const moreTasks = input.moreTasks === false ? false : input.moreTasks === true ? true : null;
+    const nextTaskId = input.nextTaskId ? String(input.nextTaskId) : null;
+    if (!workflowId || !SAFE_ID_RE7.test(workflowId)) {
+      return failure("task-complete", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!taskId || !SAFE_ID_RE7.test(taskId)) {
+      return failure("task-complete", "taskId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (moreTasks === null) {
+      return failure("task-complete", "moreTasks must be explicitly true or false", { operationId: opId, retryable: false });
+    }
+    if (moreTasks && (!nextTaskId || !SAFE_ID_RE7.test(nextTaskId))) {
+      return failure("task-complete", "nextTaskId required when moreTasks=true", { operationId: opId, retryable: false });
+    }
+    const lock = await readLock2(deps.repoRoot);
+    if (!isSetupComplete(lock)) {
+      return failure("task-complete", "setup is not complete; run /setup-ship-workflow first", { operationId: opId, retryable: false });
+    }
+    let runState;
+    try {
+      runState = await readRunState(deps.repoRoot, workflowId);
+    } catch (err) {
+      return failure("task-complete", `run state unreadable: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!runState) {
+      return failure("task-complete", "run not started", { operationId: opId, retryable: false });
+    }
+    if (runState.state !== "committed") {
+      return failure("task-complete", `task-commit must precede task-complete; run state=${runState.state}`, { operationId: opId, retryable: false });
+    }
+    try {
+      const commonDir = await resolveGitCommonDir(deps.repoRoot);
+      const completeDir = join12(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "complete");
+      await mkdir11(completeDir, { recursive: true });
+      const record2 = {
+        workflowId,
+        taskId,
+        moreTasks,
+        nextTaskId: nextTaskId ?? null,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await publishImmutableJson(join12(completeDir, "complete.json"), record2);
+      const { state, event } = await appendRunEvent(
+        deps.repoRoot,
+        workflowId,
+        runState,
+        { kind: RUN_EVENT_KINDS.TASK_COMPLETE, data: { taskId, moreTasks, nextTaskId: nextTaskId ?? null } }
+      );
+      return success2("task-complete", {
+        workflowId,
+        taskId,
+        moreTasks,
+        nextTaskId: nextTaskId ?? null,
+        state: state.state,
+        sequence: event.sequence
+      }, { operationId: opId });
+    } catch (err) {
+      return failure("task-complete", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/ship-task-report.js
+import { mkdir as mkdir12 } from "node:fs/promises";
+import { createHash as createHash7 } from "node:crypto";
+import { join as join13 } from "node:path";
+var SAFE_ID_RE8 = /^[A-Za-z0-9._-]{1,128}$/;
 function createTaskReportTool(deps) {
   return async function taskReport(input) {
     const opId = input.operationId ?? `task-report-${Date.now().toString(36)}`;
@@ -15710,10 +16003,10 @@ function createTaskReportTool(deps) {
     const round = Number(input.round ?? 1);
     const submittedBy = String(input.submittedBy ?? "");
     const summary = String(input.summary ?? "");
-    if (!workflowId || !SAFE_ID_RE5.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE8.test(workflowId)) {
       return failure("task-report", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
-    if (!taskId || !SAFE_ID_RE5.test(taskId)) {
+    if (!taskId || !SAFE_ID_RE8.test(taskId)) {
       return failure("task-report", "taskId required (safe id)", { operationId: opId, retryable: false });
     }
     if (!Number.isInteger(round) || round <= 0) {
@@ -15746,8 +16039,8 @@ function createTaskReportTool(deps) {
     }
     try {
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
-      const reportDir = join10(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
-      await mkdir8(reportDir, { recursive: true });
+      const reportDir = join13(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
+      await mkdir12(reportDir, { recursive: true });
       const record2 = {
         workflowId,
         taskId,
@@ -15759,7 +16052,7 @@ function createTaskReportTool(deps) {
         tests: Array.isArray(input.tests) ? input.tests : [],
         submittedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      await publishImmutableJson(join10(reportDir, "implementer-report.json"), record2);
+      await publishImmutableJson(join13(reportDir, "implementer-report.json"), record2);
       const { state, event } = await appendRunEvent(
         deps.repoRoot,
         workflowId,
@@ -15776,14 +16069,14 @@ function reportHash(record2) {
   const sorted = Object.keys(record2).sort();
   const ordered = {};
   for (const k of sorted) ordered[k] = record2[k];
-  return createHash6("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
+  return createHash7("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
 }
 
 // src/tools/ship-task-review.js
-import { createHash as createHash7 } from "node:crypto";
-import { mkdir as mkdir9 } from "node:fs/promises";
-import { join as join11 } from "node:path";
-var SAFE_ID_RE6 = /^[A-Za-z0-9._-]{1,128}$/;
+import { createHash as createHash8 } from "node:crypto";
+import { mkdir as mkdir13 } from "node:fs/promises";
+import { join as join14 } from "node:path";
+var SAFE_ID_RE9 = /^[A-Za-z0-9._-]{1,128}$/;
 var VERDICT_VALUES = /* @__PURE__ */ new Set(["pass", "fail", "none"]);
 function createTaskReviewTool(deps) {
   return async function taskReview(input) {
@@ -15794,10 +16087,10 @@ function createTaskReviewTool(deps) {
     const spec = input.spec;
     const quality = input.quality;
     const submittedBy = String(input.submittedBy ?? "");
-    if (!workflowId || !SAFE_ID_RE6.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE9.test(workflowId)) {
       return failure("task-review", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
-    if (!taskId || !SAFE_ID_RE6.test(taskId)) {
+    if (!taskId || !SAFE_ID_RE9.test(taskId)) {
       return failure("task-review", "taskId required (safe id)", { operationId: opId, retryable: false });
     }
     if (!Number.isInteger(round) || round <= 0) {
@@ -15818,8 +16111,8 @@ function createTaskReviewTool(deps) {
     } catch (err) {
       return failure("task-review", `reviewer model unresolved: ${err?.message ?? err}`, { operationId: opId, retryable: false });
     }
-    if (!submittedBy.startsWith(models.finalReviewer)) {
-      return failure("task-review", `submittedBy must be the configured finalReviewer model ${models.finalReviewer}`, { operationId: opId, retryable: false });
+    if (!submittedBy.startsWith(models.builder)) {
+      return failure("task-review", `submittedBy must be the configured builder model ${models.builder}`, { operationId: opId, retryable: false });
     }
     let runState;
     try {
@@ -15835,8 +16128,8 @@ function createTaskReviewTool(deps) {
     }
     try {
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
-      const reviewDir = join11(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
-      await mkdir9(reviewDir, { recursive: true });
+      const reviewDir = join14(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
+      await mkdir13(reviewDir, { recursive: true });
       const specPass = String(spec.verdict) === "pass";
       const qualityPass = String(quality.verdict) === "pass";
       const reviewHash = verdictHash({ spec, quality, submittedBy, taskId, round });
@@ -15845,13 +16138,13 @@ function createTaskReviewTool(deps) {
         taskId,
         round,
         submittedBy,
-        reviewer: models.finalReviewer,
+        reviewer: models.builder,
         spec,
         quality,
         state: specPass && qualityPass ? "commit-pending" : "fix-pending",
         reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      await publishImmutableJson(join11(reviewDir, "review.json"), record2);
+      await publishImmutableJson(join14(reviewDir, "review.json"), record2);
       const verdict = specPass && qualityPass ? "pass" : "fail";
       const { state, event } = await appendRunEvent(
         deps.repoRoot,
@@ -15869,13 +16162,124 @@ function verdictHash(record2) {
   const sorted = Object.keys(record2).sort();
   const ordered = {};
   for (const k of sorted) ordered[k] = record2[k];
-  return createHash7("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
+  return createHash8("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
+}
+
+// src/tools/ship-final-review.js
+import { mkdir as mkdir14 } from "node:fs/promises";
+import { join as join15 } from "node:path";
+var SAFE_ID_RE10 = /^[A-Za-z0-9._-]{1,128}$/;
+var AXES = /* @__PURE__ */ new Set(["standards", "spec"]);
+var VERDICTS = /* @__PURE__ */ new Set(["pass", "fail", "blocked"]);
+function createFinalReviewTool(deps) {
+  return async function finalReview(input) {
+    const opId = input.operationId ?? `final-review-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    const axis = String(input.axis ?? "");
+    const verdict = String(input.verdict ?? "");
+    const headSha = String(input.headSha ?? "");
+    const mergeBaseSha = String(input.mergeBaseSha ?? "");
+    const packageHash = String(input.packageHash ?? "");
+    const submittedBy = String(input.submittedBy ?? "");
+    const findings = Array.isArray(input.findings) ? input.findings : [];
+    if (!workflowId || !SAFE_ID_RE10.test(workflowId)) {
+      return failure("final-review", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!AXES.has(axis)) {
+      return failure("final-review", "axis must be 'standards' or 'spec'", { operationId: opId, retryable: false });
+    }
+    if (!VERDICTS.has(verdict)) {
+      return failure("final-review", "verdict must be one of pass|fail|blocked", { operationId: opId, retryable: false });
+    }
+    if (!/^[0-9a-f]{40}$/.test(headSha)) {
+      return failure("final-review", "headSha required (40-char commit SHA)", { operationId: opId, retryable: false });
+    }
+    if (!/^[0-9a-f]{40}$/.test(mergeBaseSha)) {
+      return failure("final-review", "mergeBaseSha required (40-char commit SHA)", { operationId: opId, retryable: false });
+    }
+    if (!/^[0-9a-f]{64}$/.test(packageHash)) {
+      return failure("final-review", "packageHash required (sha256)", { operationId: opId, retryable: false });
+    }
+    if (!submittedBy) {
+      return failure("final-review", "submittedBy required (must identify finalReviewer model)", { operationId: opId, retryable: false });
+    }
+    const lock = await readLock2(deps.repoRoot);
+    if (!isSetupComplete(lock)) {
+      return failure("final-review", "setup is not complete; run /setup-ship-workflow first", { operationId: opId, retryable: false });
+    }
+    let models;
+    try {
+      models = resolveModelRoles(deps.config?.workflow, { strict: true });
+    } catch (err) {
+      return failure("final-review", `final reviewer model unresolved: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!submittedBy.startsWith(models.finalReviewer)) {
+      return failure("final-review", `submittedBy must be the configured finalReviewer model ${models.finalReviewer}`, { operationId: opId, retryable: false });
+    }
+    let runState;
+    try {
+      runState = await readRunState(deps.repoRoot, workflowId);
+    } catch (err) {
+      return failure("final-review", `run state unreadable: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!runState) {
+      return failure("final-review", "run not started", { operationId: opId, retryable: false });
+    }
+    if (runState.state !== "all-tasks-done" && runState.state !== "ready-pending") {
+      return failure("final-review", `final review requires all-tasks-done; run state=${runState.state}`, { operationId: opId, retryable: false });
+    }
+    try {
+      const commonDir = await resolveGitCommonDir(deps.repoRoot);
+      const reviewDir = join15(opencodeShipStateDir(commonDir), "runs", workflowId, "final-review", axis);
+      await mkdir14(reviewDir, { recursive: true });
+      const record2 = {
+        workflowId,
+        axis,
+        verdict,
+        headSha,
+        mergeBaseSha,
+        packageHash,
+        submittedBy,
+        reviewer: models.finalReviewer,
+        findings,
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await publishImmutableJson(join15(reviewDir, "review.json"), record2);
+      const { state, event } = await appendRunEvent(
+        deps.repoRoot,
+        workflowId,
+        runState,
+        {
+          kind: RUN_EVENT_KINDS.FINAL_REVIEW,
+          data: {
+            axis,
+            verdict,
+            headSha,
+            mergeBaseSha,
+            packageHash,
+            review: { verdict, headSha, mergeBaseSha, packageHash }
+          }
+        }
+      );
+      return success2("final-review", {
+        workflowId,
+        axis,
+        verdict,
+        headSha,
+        state: state.state,
+        sequence: event.sequence,
+        finalReview: state.finalReview ?? null
+      }, { operationId: opId });
+    } catch (err) {
+      return failure("final-review", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
 }
 
 // src/workflow/resume.js
-import { readFile as readFile8, writeFile as writeFile8, readdir as readdir6, mkdir as mkdir10 } from "node:fs/promises";
-import { existsSync as existsSync7 } from "node:fs";
-import { join as join12 } from "node:path";
+import { readFile as readFile10, writeFile as writeFile9, readdir as readdir6, mkdir as mkdir15 } from "node:fs/promises";
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join16 } from "node:path";
 function parseTrailer(text, key) {
   if (typeof text !== "string") return null;
   const re = new RegExp(`^${key}:\\s*(.+)$`, "m");
@@ -15949,12 +16353,12 @@ async function resumeRun(repoRoot, workflowId) {
 }
 
 // src/tools/ship-resume.js
-var SAFE_ID_RE7 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE11 = /^[A-Za-z0-9._-]{1,128}$/;
 function createResumeTool(deps) {
   return async function resume(input) {
     const opId = input.operationId ?? `resume-${Date.now().toString(36)}`;
     const workflowId = String(input.workflowId ?? "");
-    if (!workflowId || !SAFE_ID_RE7.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE11.test(workflowId)) {
       return failure("resume", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
     try {
@@ -15972,9 +16376,9 @@ function createResumeTool(deps) {
 }
 
 // src/tools/ship-status.js
-import { readFile as readFile9, readdir as readdir7 } from "node:fs/promises";
-import { existsSync as existsSync8 } from "node:fs";
-import { join as join13 } from "node:path";
+import { readFile as readFile11, readdir as readdir7 } from "node:fs/promises";
+import { existsSync as existsSync10 } from "node:fs";
+import { join as join17 } from "node:path";
 function createStatusTool(deps) {
   return async function status(input) {
     const opId = input.operationId ?? `status-${Date.now().toString(36)}`;
@@ -15982,21 +16386,21 @@ function createStatusTool(deps) {
     if (!workflowId) return failure("status", "workflowId required", { operationId: opId, retryable: false });
     try {
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
-      const planRoot = join13(opencodeShipStateDir(commonDir), "plans", workflowId);
-      const runRoot = join13(opencodeShipStateDir(commonDir), "runs", workflowId);
-      const indexPath = join13(planRoot, "index.json");
-      if (!existsSync8(indexPath)) return failure("status", "no workflow record", { operationId: opId, retryable: false });
-      const index = JSON.parse(await readFile9(indexPath, "utf8"));
+      const planRoot = join17(opencodeShipStateDir(commonDir), "plans", workflowId);
+      const runRoot = join17(opencodeShipStateDir(commonDir), "runs", workflowId);
+      const indexPath = join17(planRoot, "index.json");
+      if (!existsSync10(indexPath)) return failure("status", "no workflow record", { operationId: opId, retryable: false });
+      const index = JSON.parse(await readFile11(indexPath, "utf8"));
       let run = null;
-      const runPath = join13(runRoot, "run.json");
-      if (existsSync8(runPath)) run = JSON.parse(await readFile9(runPath, "utf8"));
+      const runPath = join17(runRoot, "run.json");
+      if (existsSync10(runPath)) run = JSON.parse(await readFile11(runPath, "utf8"));
       let lastEvent = null;
-      const eventsDir = join13(runRoot, "events");
-      if (existsSync8(eventsDir)) {
+      const eventsDir = join17(runRoot, "events");
+      if (existsSync10(eventsDir)) {
         const events = await readdir7(eventsDir);
         const sorted = events.filter((n) => n.endsWith(".json")).sort();
         if (sorted.length > 0) {
-          lastEvent = JSON.parse(await readFile9(join13(eventsDir, sorted[sorted.length - 1]), "utf8"));
+          lastEvent = JSON.parse(await readFile11(join17(eventsDir, sorted[sorted.length - 1]), "utf8"));
         }
       }
       return success2("status", { workflowId, index, run, lastEvent }, { operationId: opId });
@@ -16006,6 +16410,537 @@ function createStatusTool(deps) {
   };
 }
 
+// src/skills/registry.js
+import { spawn as spawn7 } from "node:child_process";
+import { readFile as readFile12, writeFile as writeFile10, mkdir as mkdir16 } from "node:fs/promises";
+import { resolve as resolve11, dirname as dirname7 } from "node:path";
+import { createHash as createHash9 } from "node:crypto";
+
+// src/tools/skill-discovery.js
+import { spawn as spawn6 } from "node:child_process";
+import { existsSync as existsSync11, readFileSync, writeFileSync, mkdirSync, readdirSync, statSync } from "node:fs";
+import { dirname as dirname6, join as join18, normalize, resolve as resolve10, sep } from "node:path";
+var DEFAULT_TRUSTED_OWNERS = Object.freeze([
+  "vercel-labs",
+  "anthropics",
+  "obra",
+  "mattpocock",
+  "ComposioHQ"
+]);
+function runCapture(cmd, args, options) {
+  const cwd = options?.cwd;
+  const timeoutMs = options?.timeoutMs ?? 6e4;
+  return new Promise((resolveP, rejectP) => {
+    const child = spawn6(cmd, args, { cwd, shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      rejectP(new Error(`skill-discovery: timeout running '${cmd} ${args.join(" ")}'`));
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf8");
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf8");
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      rejectP(err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolveP({ code, stdout, stderr });
+    });
+  });
+}
+async function discoverSkills({ repoRoot, query, npmBin = "npx" }) {
+  if (!repoRoot || !query) {
+    return { ok: false, error: { kind: "missing-args" } };
+  }
+  const r = await runCapture(npmBin, ["skills", "find", query], { cwd: repoRoot, timeoutMs: 6e4 });
+  if (r.code !== 0 && !r.stdout.trim()) {
+    return { ok: false, error: { kind: "registry-unavailable", stderr: r.stderr } };
+  }
+  return { ok: true, candidates: parseFindOutput(r.stdout), raw: r.stdout };
+}
+function parseFindOutput(text) {
+  const lines = text.split(/\r?\n/);
+  const candidates = [];
+  for (const line of lines) {
+    const match = line.match(/^\s*([a-zA-Z0-9_.\-]+)\s+([a-zA-Z0-9_.\-/]+)\s+([0-9]+)\s*$/);
+    if (!match) continue;
+    candidates.push({
+      skill: match[1],
+      package: match[2],
+      installs: Number.parseInt(match[3], 10)
+    });
+  }
+  return candidates;
+}
+
+// src/skills/registry.js
+var SKILLS_CLI_TIMEOUT_MS = 60 * 1e3;
+var SKILLS_INSTALL_TIMEOUT_MS = 120 * 1e3;
+function runCapture2(cmd, args, options = {}) {
+  const cwd = options.cwd;
+  const timeoutMs = options.timeoutMs ?? 6e4;
+  const stdin = options.stdin;
+  return new Promise((resolveP, rejectP) => {
+    const child = spawn7(cmd, args, { cwd, shell: false, stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      rejectP(new Error(`skill-registry: timeout running '${cmd} ${args.join(" ")}'`));
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf8");
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf8");
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      rejectP(err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolveP({ code, stdout, stderr });
+    });
+    if (stdin !== void 0) {
+      child.stdin.write(stdin);
+      child.stdin.end();
+    }
+  });
+}
+async function listSkills({ repoRoot, query, npmBin = "npx" }) {
+  return discoverSkills({ repoRoot, query, npmBin });
+}
+async function fetchSkillBytes({ repoRoot, packageSpec, npmBin = "npx" }) {
+  const r = await runCapture2(npmBin, ["view", packageSpec, "dist.tarball"], {
+    cwd: repoRoot,
+    timeoutMs: SKILLS_CLI_TIMEOUT_MS
+  });
+  if (r.code !== 0) {
+    return { ok: false, error: { kind: "registry-unavailable", stderr: r.stderr } };
+  }
+  const tarball = r.stdout.trim();
+  if (!/^https?:\/\//.test(tarball)) {
+    return { ok: false, error: { kind: "bad-tarball-url", tarball } };
+  }
+  return { ok: true, tarball };
+}
+
+// src/skills/policy.js
+import { readFile as readFile13, writeFile as writeFile11 } from "node:fs/promises";
+import { existsSync as existsSync12 } from "node:fs";
+import { resolve as resolve12 } from "node:path";
+var DEFAULT_TRUSTED_OWNERS2 = Object.freeze([
+  "vercel-labs",
+  "anthropics",
+  "obra",
+  "mattpocock",
+  "ComposioHQ"
+]);
+var DEFAULT_MIN_INSTALLS = 1e3;
+var MAX_TRUSTED_PER_RUN = 5;
+var POLICY_PATH = ".opencode/ship.skills.policy.json";
+function policyPath(repoRoot) {
+  return resolve12(repoRoot, POLICY_PATH);
+}
+function defaultPolicy() {
+  return {
+    trustedOwners: [...DEFAULT_TRUSTED_OWNERS2],
+    minInstalls: DEFAULT_MIN_INSTALLS,
+    blocklist: [],
+    maxTrustedPerRun: MAX_TRUSTED_PER_RUN
+  };
+}
+async function readPolicy(repoRoot) {
+  const path = policyPath(repoRoot);
+  if (!existsSync12(path)) return defaultPolicy();
+  try {
+    const raw = await readFile13(path, "utf8");
+    const parsed = JSON.parse(raw);
+    return mergePolicy(defaultPolicy(), parsed);
+  } catch {
+    return defaultPolicy();
+  }
+}
+function mergePolicy(base, override) {
+  const out = { ...base };
+  if (Array.isArray(override?.trustedOwners)) {
+    out.trustedOwners = [...new Set(override.trustedOwners)];
+  }
+  if (Number.isInteger(override?.minInstalls)) {
+    out.minInstalls = override.minInstalls;
+  }
+  if (Array.isArray(override?.blocklist)) {
+    out.blocklist = [...new Set(override.blocklist)];
+  }
+  if (Number.isInteger(override?.maxTrustedPerRun)) {
+    out.maxTrustedPerRun = override.maxTrustedPerRun;
+  }
+  return out;
+}
+function isAutoInstallable(candidate, policy) {
+  if (!candidate || typeof candidate !== "object") {
+    return { ok: false, reason: "missing-candidate" };
+  }
+  if ((policy.blocklist ?? []).includes(candidate.package)) {
+    return { ok: false, reason: "blocked" };
+  }
+  const owner = String(candidate.package).split("/")[0];
+  if (!(policy.trustedOwners ?? []).includes(owner)) {
+    return { ok: false, reason: "untrusted-owner" };
+  }
+  if (candidate.installs < (policy.minInstalls ?? DEFAULT_MIN_INSTALLS)) {
+    return { ok: false, reason: "below-threshold" };
+  }
+  return { ok: true };
+}
+
+// src/tools/ship-skill-discover.js
+function createSkillDiscoverTool(deps) {
+  return async function skillDiscover(input) {
+    const opId = input.operationId ?? `skill-discover-${Date.now().toString(36)}`;
+    const query = String(input.query ?? "");
+    if (!query) {
+      return failure("skill-discover", "query required", { operationId: opId, retryable: false });
+    }
+    let policy;
+    try {
+      policy = await readPolicy(deps.repoRoot);
+    } catch (err) {
+      return failure("skill-discover", `policy unreadable: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    let result;
+    try {
+      result = await listSkills({ repoRoot: deps.repoRoot, query });
+    } catch (err) {
+      return failure("skill-discover", `registry unavailable: ${err?.message ?? err}`, { operationId: opId, retryable: true });
+    }
+    if (!result.ok) {
+      return failure("skill-discover", result.error?.kind ?? "registry-unavailable", { operationId: opId, retryable: true });
+    }
+    const auto = [];
+    const needsApproval = [];
+    let autoCount = 0;
+    for (const candidate of result.candidates ?? []) {
+      if (policy.blocklist.includes(candidate.package)) continue;
+      const decision = isAutoInstallable(candidate, policy);
+      if (decision.ok && autoCount < policy.maxTrustedPerRun) {
+        auto.push(candidate);
+        autoCount += 1;
+      } else {
+        needsApproval.push({ ...candidate, reason: decision.reason ?? "needs-approval" });
+      }
+    }
+    return success2("skill-discover", {
+      query,
+      policy,
+      auto,
+      needsApproval,
+      total: (result.candidates ?? []).length
+    }, { operationId: opId });
+  };
+}
+
+// src/tools/ship-skill-install.js
+import { execFile as execFile2 } from "node:child_process";
+import { readFile as readFile15, mkdir as mkdir18, writeFile as writeFile13 } from "node:fs/promises";
+import { existsSync as existsSync14 } from "node:fs";
+import { resolve as resolve14, join as join19, dirname as dirname9, sep as sep2 } from "node:path";
+import { createHash as createHash11 } from "node:crypto";
+
+// src/skills/inventory.js
+import { readFile as readFile14, writeFile as writeFile12, mkdir as mkdir17, rename as rename4 } from "node:fs/promises";
+import { existsSync as existsSync13 } from "node:fs";
+import { resolve as resolve13, dirname as dirname8 } from "node:path";
+import { createHash as createHash10 } from "node:crypto";
+var INVENTORY_PATH = ".opencode/ship.skills.lock.json";
+function inventoryPath(repoRoot) {
+  return resolve13(repoRoot, INVENTORY_PATH);
+}
+async function readInventory(repoRoot) {
+  const path = inventoryPath(repoRoot);
+  if (!existsSync13(path)) {
+    return { schemaVersion: 1, entries: [] };
+  }
+  try {
+    const raw = await readFile14(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") {
+      return { schemaVersion: 1, entries: [] };
+    }
+    if (!Array.isArray(parsed.entries)) parsed.entries = [];
+    if (!Number.isInteger(parsed.schemaVersion)) parsed.schemaVersion = 1;
+    return parsed;
+  } catch {
+    return { schemaVersion: 1, entries: [] };
+  }
+}
+async function writeInventory(repoRoot, inventory) {
+  const path = inventoryPath(repoRoot);
+  await mkdir17(dirname8(path), { recursive: true });
+  const tmp = `${path}.${Date.now().toString(36)}.tmp`;
+  await writeFile12(tmp, JSON.stringify(inventory, null, 2) + "\n", "utf8");
+  await rename4(tmp, path);
+  return path;
+}
+function canonicalize3(value) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  const sort = (v) => {
+    if (v === null || typeof v !== "object") return v;
+    if (seen.has(v)) return null;
+    seen.add(v);
+    if (Array.isArray(v)) return v.map(sort);
+    const out = {};
+    for (const k of Object.keys(v).sort()) out[k] = sort(v[k]);
+    return out;
+  };
+  return JSON.stringify(sort(value));
+}
+function hashEntry(entry) {
+  return createHash10("sha256").update(canonicalize3(entry), "utf8").digest("hex");
+}
+async function appendEntry(repoRoot, entry) {
+  const inventory = await readInventory(repoRoot);
+  const previousHash = inventory.entries.length > 0 ? inventory.entries[inventory.entries.length - 1].hash : "0".repeat(64);
+  const stamped = {
+    ...entry,
+    sequence: inventory.entries.length + 1,
+    previousHash,
+    recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  stamped.hash = hashEntry({ ...stamped, hash: void 0 });
+  inventory.entries.push(stamped);
+  await writeInventory(repoRoot, inventory);
+  return stamped;
+}
+async function verifyInventory(repoRoot) {
+  const inventory = await readInventory(repoRoot);
+  let prev = "0".repeat(64);
+  for (const entry of inventory.entries) {
+    if (entry.previousHash !== prev) {
+      return { ok: false, reason: "chain-break", entry: entry.sequence };
+    }
+    const recomputed = hashEntry({ ...entry, hash: void 0 });
+    if (recomputed !== entry.hash) {
+      return { ok: false, reason: "hash-mismatch", entry: entry.sequence };
+    }
+    prev = entry.hash;
+  }
+  return { ok: true, count: inventory.entries.length };
+}
+
+// src/tools/ship-skill-install.js
+var SAFE_ID_RE12 = /^[A-Za-z0-9._-]{1,128}$/;
+function isInside(parent, child) {
+  const a = resolve14(parent) + sep2;
+  const b = resolve14(child);
+  return b.startsWith(a) || b === resolve14(parent);
+}
+function createSkillInstallTool(deps) {
+  return async function skillInstall(input) {
+    const opId = input.operationId ?? `skill-install-${Date.now().toString(36)}`;
+    const packageSpec = String(input.package ?? "");
+    const worktreePath = String(input.worktreePath ?? "");
+    const skillName = String(input.skillName ?? "");
+    const version2 = String(input.version ?? "latest");
+    if (!packageSpec || !/^[A-Za-z0-9._/@-]+$/.test(packageSpec)) {
+      return failure("skill-install", "package required (safe npm spec)", { operationId: opId, retryable: false });
+    }
+    if (!worktreePath) {
+      return failure("skill-install", "worktreePath required (must be the active issue worktree)", { operationId: opId, retryable: false });
+    }
+    if (!skillName || !SAFE_ID_RE12.test(skillName)) {
+      return failure("skill-install", "skillName required (safe id)", { operationId: opId, retryable: false });
+    }
+    const policy = await readPolicy(deps.repoRoot);
+    const candidate = { package: packageSpec, skill: skillName, installs: policy.minInstalls + 1 };
+    const decision = isAutoInstallable(candidate, policy);
+    if (!decision.ok) {
+      return failure("skill-install", `policy forbids install: ${decision.reason}`, { operationId: opId, retryable: false });
+    }
+    const wt = resolve14(worktreePath);
+    const mainRepo = resolve14(deps.repoRoot);
+    if (wt === mainRepo) {
+      return failure("skill-install", "installs into the main worktree are forbidden", { operationId: opId, retryable: false });
+    }
+    if (!isInside(mainRepo, wt) && !isInside(wt, mainRepo)) {
+      return failure("skill-install", "worktreePath must be inside the active repository", { operationId: opId, retryable: false });
+    }
+    const destDir = resolve14(wt, ".opencode", "skills", skillName);
+    if (existsSync14(destDir)) {
+      return failure("skill-install", "destination already exists; use ship_skill_audit to detect drift", { operationId: opId, retryable: false });
+    }
+    const managedCatalog = (deps.config?.value?.skills ?? []).map((s) => s?.name).filter(Boolean);
+    if (managedCatalog.includes(skillName)) {
+      return failure("skill-install", "candidate shadows a managed skill", { operationId: opId, retryable: false });
+    }
+    let resolved;
+    try {
+      resolved = await fetchSkillBytes({ repoRoot: deps.repoRoot, packageSpec: `${packageSpec}@${version2}` });
+    } catch (err) {
+      return failure("skill-install", `registry fetch failed: ${err?.message ?? err}`, { operationId: opId, retryable: true });
+    }
+    if (!resolved.ok) {
+      return failure("skill-install", resolved.error?.kind ?? "registry-unavailable", { operationId: opId, retryable: true });
+    }
+    let fetched;
+    try {
+      const tarBytes = await fetchTarball(resolved.tarball);
+      fetched = { tarball: resolved.tarball, sha256: createHash11("sha256").update(tarBytes).digest("hex"), bytes: tarBytes };
+    } catch (err) {
+      return failure("skill-install", `tarball download failed: ${err?.message ?? err}`, { operationId: opId, retryable: true });
+    }
+    try {
+      await mkdir18(destDir, { recursive: true });
+      await writeFile13(join19(destDir, "SKILL.md"), `# Trusted-installed skill
+
+package: ${packageSpec}
+install: pinned@${version2}
+tarball: ${fetched.tarball}
+sha256: ${fetched.sha256}
+worktree: ${wt}
+recordedAt: ${(/* @__PURE__ */ new Date()).toISOString()}
+`, "utf8");
+      const recorded = await appendEntry(deps.repoRoot, {
+        skill: skillName,
+        package: packageSpec,
+        version: version2,
+        worktreePath: wt,
+        tarball: fetched.tarball,
+        sha256: fetched.sha256,
+        destDir,
+        recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      return success2("skill-install", {
+        skill: skillName,
+        package: packageSpec,
+        version: version2,
+        destDir,
+        sha256: fetched.sha256,
+        sequence: recorded.sequence
+      }, { operationId: opId });
+    } catch (err) {
+      return failure("skill-install", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+async function fetchTarball(url2) {
+  const { request } = await import("node:https");
+  const { request: httpRequest } = await import("node:http");
+  const { URL: URL2 } = await import("node:url");
+  const parsed = new URL2(url2);
+  const lib = parsed.protocol === "https:" ? request : httpRequest;
+  return new Promise((resolveP, rejectP) => {
+    const req = lib(url2, { method: "GET" }, (res) => {
+      if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        resolveP(fetchTarball(res.headers.location));
+        return;
+      }
+      if (res.statusCode !== 200) {
+        rejectP(new Error(`tarball fetch returned HTTP ${res.statusCode}`));
+        return;
+      }
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => resolveP(Buffer.concat(chunks)));
+      res.on("error", rejectP);
+    });
+    req.on("error", rejectP);
+    req.end();
+  });
+}
+
+// src/tools/ship-skill-audit.js
+import { readdir as readdir8, readFile as readFile16 } from "node:fs/promises";
+import { existsSync as existsSync15 } from "node:fs";
+import { resolve as resolve15, join as join20 } from "node:path";
+import { createHash as createHash12 } from "node:crypto";
+function createSkillAuditTool(deps) {
+  return async function skillAudit(input) {
+    const opId = input.operationId ?? `skill-audit-${Date.now().toString(36)}`;
+    const repoRoot = resolve15(deps.repoRoot);
+    const inventory = await readInventory(repoRoot);
+    const chain = await verifyInventory(repoRoot);
+    const missing = [];
+    const drifted = [];
+    const colliding = [];
+    for (const entry of inventory.entries) {
+      const skillPath = join20(repoRoot, entry.destDir ?? "", "SKILL.md");
+      if (!existsSync15(skillPath)) {
+        missing.push({ skill: entry.skill, sequence: entry.sequence });
+        continue;
+      }
+      const raw = await readFile16(skillPath, "utf8");
+      const sha = createHash12("sha256").update(raw, "utf8").digest("hex");
+      const expected = entry.sha256 ?? entry.hash;
+      if (sha !== expected) {
+        drifted.push({ skill: entry.skill, sequence: entry.sequence, expected, actual: sha });
+      }
+    }
+    const untracked = [];
+    const opencodeDir = join20(repoRoot, ".opencode", "skills");
+    if (existsSync15(opencodeDir)) {
+      const entries = await readdir8(opencodeDir, { withFileTypes: true }).catch(() => []);
+      for (const e of entries) {
+        if (!e.isDirectory()) continue;
+        const recorded = inventory.entries.find((en) => en.skill === e.name);
+        if (!recorded) {
+          untracked.push({ skill: e.name });
+        }
+      }
+    }
+    return success2("skill-audit", {
+      chain,
+      missing,
+      drifted,
+      untracked,
+      colliding,
+      total: inventory.entries.length
+    }, { operationId: opId });
+  };
+}
+
+// src/tools/ship-skill-uninstall.js
+import { readFile as readFile17, unlink as unlink5, writeFile as writeFile14 } from "node:fs/promises";
+import { existsSync as existsSync16 } from "node:fs";
+import { resolve as resolve16, join as join21 } from "node:path";
+import { createHash as createHash13 } from "node:crypto";
+var SAFE_ID_RE13 = /^[A-Za-z0-9._-]{1,128}$/;
+function createSkillUninstallTool(deps) {
+  return async function skillUninstall(input) {
+    const opId = input.operationId ?? `skill-uninstall-${Date.now().toString(36)}`;
+    const skillName = String(input.skill ?? "");
+    if (!skillName || !SAFE_ID_RE13.test(skillName)) {
+      return failure("skill-uninstall", "skill required (safe id)", { operationId: opId, retryable: false });
+    }
+    const repoRoot = resolve16(deps.repoRoot);
+    const inventory = await readInventory(repoRoot);
+    const idx = inventory.entries.findIndex((e) => e.skill === skillName);
+    if (idx === -1) {
+      return failure("skill-uninstall", "skill not in inventory", { operationId: opId, retryable: false });
+    }
+    const entry = inventory.entries[idx];
+    const target = join21(repoRoot, entry.destDir ?? "", "SKILL.md");
+    if (existsSync16(target)) {
+      const raw = await readFile17(target, "utf8");
+      const sha = createHash13("sha256").update(raw, "utf8").digest("hex");
+      if (sha !== (entry.sha256 ?? entry.hash)) {
+        return failure("skill-uninstall", "skill file drifted; refusing to remove. Resolve manually.", { operationId: opId, retryable: false });
+      }
+      await unlink5(target).catch(() => null);
+    }
+    inventory.entries.splice(idx, 1);
+    await writeInventory(repoRoot, inventory);
+    return success2("skill-uninstall", { skill: skillName, removed: true }, { operationId: opId });
+  };
+}
+
 // src/recovery.js
 function recoverManifestAfterCrash(manifest) {
   return manifest;
@@ -16022,9 +16957,9 @@ async function reconcileOwner(repoRoot, adapter) {
 }
 
 // src/installer/config.js
-import { readFile as readFile10, writeFile as writeFile9, rename as rename3, mkdir as mkdir11 } from "node:fs/promises";
-import { existsSync as existsSync9 } from "node:fs";
-import { dirname as dirname5, resolve as resolve9 } from "node:path";
+import { readFile as readFile18, writeFile as writeFile15, rename as rename5, mkdir as mkdir19 } from "node:fs/promises";
+import { existsSync as existsSync17 } from "node:fs";
+import { dirname as dirname10, resolve as resolve17 } from "node:path";
 
 // schema/ship-config.schema.json
 var ship_config_schema_default = {
@@ -16329,23 +17264,14 @@ function validateSchema(value, schema) {
   return { ok: issues.length === 0, issues };
 }
 
-// src/installer/hash.js
-import { createHash as createHash8 } from "node:crypto";
-function bytesHash(buffer) {
-  return createHash8("sha256").update(buffer).digest("hex");
-}
-function bytesHashString(text) {
-  return bytesHash(Buffer.from(text, "utf8"));
-}
-
 // src/installer/config.js
 function configPath(repoRoot) {
-  return resolve9(repoRoot, ".opencode", "ship.config.json");
+  return resolve17(repoRoot, ".opencode", "ship.config.json");
 }
 async function loadConfig(repoRoot) {
   const path = configPath(repoRoot);
-  if (!existsSync9(path)) return null;
-  const raw = await readFile10(path, "utf8");
+  if (!existsSync17(path)) return null;
+  const raw = await readFile18(path, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -16409,28 +17335,10 @@ function renderDefaultConfig(detection, overrides = {}) {
   };
 }
 
-// src/installer/lock.js
-import { readFile as readFile11, writeFile as writeFile10, rename as rename4, mkdir as mkdir12 } from "node:fs/promises";
-import { existsSync as existsSync10 } from "node:fs";
-import { dirname as dirname6, resolve as resolve10 } from "node:path";
-function lockPath(repoRoot) {
-  return resolve10(repoRoot, ".opencode", "ship.lock.json");
-}
-async function readLock2(repoRoot) {
-  const path = lockPath(repoRoot);
-  if (!existsSync10(path)) return null;
-  try {
-    const raw = await readFile11(path, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-
 // src/installer/detection/project.js
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync11, readFileSync } from "node:fs";
-import { resolve as resolve11, join as join14 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync2 } from "node:fs";
+import { resolve as resolve18, join as join22 } from "node:path";
 function runGit2(cwd, args) {
   const r = spawnSync5("git", ["-C", cwd, ...args], {
     stdio: ["ignore", "pipe", "pipe"],
@@ -16439,17 +17347,17 @@ function runGit2(cwd, args) {
   return { status: r.status ?? -1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 function detectPackageManager(repoRoot) {
-  if (existsSync11(join14(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync11(join14(repoRoot, "yarn.lock"))) return "yarn";
-  if (existsSync11(join14(repoRoot, "bun.lockb"))) return "bun";
-  if (existsSync11(join14(repoRoot, "package-lock.json"))) return "npm";
+  if (existsSync18(join22(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync18(join22(repoRoot, "yarn.lock"))) return "yarn";
+  if (existsSync18(join22(repoRoot, "bun.lockb"))) return "bun";
+  if (existsSync18(join22(repoRoot, "package-lock.json"))) return "npm";
   return null;
 }
 function readPackageJson(repoRoot) {
-  const path = join14(repoRoot, "package.json");
-  if (!existsSync11(path)) return null;
+  const path = join22(repoRoot, "package.json");
+  if (!existsSync18(path)) return null;
   try {
-    return JSON.parse(readFileSync(path, "utf8"));
+    return JSON.parse(readFileSync2(path, "utf8"));
   } catch {
     return null;
   }
@@ -16524,7 +17432,7 @@ function detectOwner(repoRoot) {
 }
 function detectProject(repoRoot = process.cwd()) {
   const errors = [];
-  const cwd = resolve11(repoRoot);
+  const cwd = resolve18(repoRoot);
   const inside = runGit2(cwd, ["rev-parse", "--show-toplevel"]);
   if (inside.status !== 0) {
     errors.push({ kind: "not-a-git-repo", path: cwd, detail: inside.stderr.trim() });
@@ -16573,8 +17481,8 @@ function detectProject(repoRoot = process.cwd()) {
 // src/installer/cleanup.js
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { resolve as pathResolve } from "node:path";
-import { existsSync as existsSync12, readFileSync as readFileSync2, writeFileSync, mkdirSync } from "node:fs";
-function spawn5(repoRoot, args) {
+import { existsSync as existsSync19, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
+function spawn8(repoRoot, args) {
   const r = spawnSync6("git", ["-C", repoRoot, ...args], { encoding: "utf8" });
   return { status: r.status ?? -1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
@@ -16585,10 +17493,10 @@ function casDeleteBranch2(repoRoot, branch, expectedSha) {
   } else {
     argv.push(`refs/heads/${branch}`);
   }
-  return spawn5(repoRoot, argv).status ?? -1;
+  return spawn8(repoRoot, argv).status ?? -1;
 }
 function safeRemoveWorktree2(repoRoot, target) {
-  const r = spawn5(repoRoot, ["worktree", "remove", target]);
+  const r = spawn8(repoRoot, ["worktree", "remove", target]);
   return { status: r.status, stderr: r.stderr };
 }
 function worktreeRootOf(adapter) {
@@ -16600,9 +17508,9 @@ async function cleanupPendingPath(repoRoot) {
 }
 async function loadCleanupPending(repoRoot) {
   const path = await cleanupPendingPath(repoRoot);
-  if (!existsSync12(path)) return [];
+  if (!existsSync19(path)) return [];
   try {
-    const raw = await readFileSync2(path, "utf8");
+    const raw = await readFileSync3(path, "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed) ? parsed : [];
   } catch {
@@ -16612,8 +17520,8 @@ async function loadCleanupPending(repoRoot) {
 async function saveCleanupPending(repoRoot, entries) {
   const path = await cleanupPendingPath(repoRoot);
   const dir = pathResolve(path, "..");
-  if (!existsSync12(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync(path, JSON.stringify(dedupePending(entries), null, 2) + "\n", "utf8");
+  if (!existsSync19(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(path, JSON.stringify(dedupePending(entries), null, 2) + "\n", "utf8");
 }
 function dedupePending(entries) {
   const seen = /* @__PURE__ */ new Set();
@@ -16650,11 +17558,11 @@ async function tryImmediateCleanup({ repoRoot, taskId, adapter }) {
   if (!wtPath.startsWith(rootAbs + "/")) {
     return reject("worktree-out-of-root", { expected: rootAbs, got: wtPath });
   }
-  const status = spawn5(wtPath, ["status", "--porcelain"]);
+  const status = spawn8(wtPath, ["status", "--porcelain"]);
   if (status.status === 0 && status.stdout.trim().length > 0) return reject("dirty-worktree");
-  const rebase = spawn5(wtPath, ["rev-parse", "--verify", "--quiet", "REBASE_HEAD"]);
+  const rebase = spawn8(wtPath, ["rev-parse", "--verify", "--quiet", "REBASE_HEAD"]);
   if (rebase.status === 0) return reject("rebase-in-progress");
-  const head = spawn5(wtPath, ["rev-parse", "HEAD"]);
+  const head = spawn8(wtPath, ["rev-parse", "HEAD"]);
   if (head.status !== 0) return reject("no-head");
   const headSha = head.stdout.trim();
   if (m.lastPrHeadSha && headSha !== m.lastPrHeadSha) {
@@ -16671,7 +17579,7 @@ async function tryImmediateCleanup({ repoRoot, taskId, adapter }) {
     return reject("remove-failed", { detail: removed.stderr });
   }
   const branchDelete = casDeleteBranch2(repoRoot, m.branch, headSha);
-  const branchStillThere = spawn5(repoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${m.branch}`]);
+  const branchStillThere = spawn8(repoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${m.branch}`]);
   if (branchDelete !== 0 && branchStillThere.status === 0) {
     await appendCleanupPending(repoRoot, {
       taskId,
@@ -16700,7 +17608,7 @@ async function listPending(repoRoot) {
 }
 
 // src/installer/ship-adapter.js
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve19 } from "node:path";
 var REQUIRED_DEFAULTS = {
   review: { agent: "delivery-reviewer", required: true, invalidateOnHeadChange: true },
   ci: { driver: "github-status-checks", requiredChecks: ["delivery-verify"], wait: true, flakyRetry: 1 },
@@ -16741,10 +17649,10 @@ function flattenShipConfig(ship) {
 }
 
 // src/version.js
-import { readFileSync as readFileSync3, existsSync as existsSync13 } from "node:fs";
-import { dirname as dirname7, resolve as resolve13 } from "node:path";
+import { readFileSync as readFileSync4, existsSync as existsSync20 } from "node:fs";
+import { dirname as dirname11, resolve as resolve20 } from "node:path";
 import { fileURLToPath } from "node:url";
-var PACKAGE_VERSION = "1.1.1";
+var PACKAGE_VERSION = "1.1.2-rc.2";
 var TEMPLATE_SET = `v${PACKAGE_VERSION}`;
 
 // src/plugin.js
@@ -16769,10 +17677,18 @@ var toolDefs = [
   ["ship_plan_submit", "Planner-only immutable PlanV2 submission.", "planSubmit"],
   ["ship_plan_approve", "Interactive approval + immutable local seal.", "planApprove"],
   ["ship_run_start", "Start execution of an approved plan.", "runStart"],
+  ["ship_task_start", "Dispatch a task to the configured builder agent.", "taskStart"],
+  ["ship_task_commit", "Record the immutable commit binding for a reviewed task.", "taskCommit"],
+  ["ship_task_complete", "Advance the run to the next task or to ALL_TASKS_DONE.", "taskComplete"],
   ["ship_task_report", "Builder-only immutable task report.", "taskReport"],
   ["ship_task_review", "Task reviewer Spec/Quality verdict.", "taskReview"],
+  ["ship_final_review", "Record one final review axis (standards or spec).", "finalReview"],
   ["ship_resume", "Restore, reconcile, and continue idempotently.", "resume"],
-  ["ship_status", "Read-only compact workflow state.", "status"]
+  ["ship_status", "Read-only compact workflow state.", "status"],
+  ["ship_skill_discover", "Query the trusted skill registry and partition candidates.", "skillDiscover"],
+  ["ship_skill_install", "Install a trusted skill into the active issue worktree.", "skillInstall"],
+  ["ship_skill_audit", "Audit the installed trusted skills inventory.", "skillAudit"],
+  ["ship_skill_uninstall", "Remove a trusted skill whose recorded sha256 still matches.", "skillUninstall"]
 ];
 function wrapEnvelopeV2(id, result) {
   if (result && typeof result === "object" && result.contractVersion === 2) {
@@ -16825,7 +17741,7 @@ async function resolveRepoSlug(repoRoot, detection, config2) {
   const fromConfig = config2?.value?.project?.repository;
   if (typeof fromConfig === "string" && fromConfig.includes("/")) return fromConfig;
   if (detection?.repository) return detection.repository;
-  const gitConfig = await readFile12(resolve14(repoRoot, ".git/config"), "utf8").catch(() => null);
+  const gitConfig = await readFile19(resolve21(repoRoot, ".git/config"), "utf8").catch(() => null);
   if (gitConfig) {
     const m = gitConfig.match(/url\s*=\s*.*?github\.com[:/]([^/]+)\/([^/\s]+?)(?:\.git)?\b/);
     if (m) return `${m[1]}/${m[2]}`;
@@ -16857,7 +17773,7 @@ async function bestEffortCleanupQueue(repoRoot, adapter) {
   return { pending, manifestTasks: tasks.map((t) => t.taskId), ...out };
 }
 async function buildRuntime(worktree) {
-  const repoRootAbs = resolve14(worktree ?? process.cwd());
+  const repoRootAbs = resolve21(worktree ?? process.cwd());
   const detection = detectProject(repoRootAbs);
   const legacyAdapter = await loadAdapter(repoRootAbs);
   const config2 = await loadConfig(repoRootAbs);
@@ -17115,6 +18031,116 @@ var factories = {
       config: rt.configValue
     })
   },
+  taskStart: {
+    args: {
+      workflowId: tool.schema.string(),
+      taskId: tool.schema.string(),
+      briefHash: tool.schema.string(),
+      sessionID: tool.schema.string(),
+      submittedBy: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createTaskStartTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
+  taskCommit: {
+    args: {
+      workflowId: tool.schema.string(),
+      taskId: tool.schema.string(),
+      expectedHead: tool.schema.string(),
+      commitSha: tool.schema.string(),
+      planHash: tool.schema.string(),
+      reviewHash: tool.schema.string(),
+      round: tool.schema.number(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createTaskCommitTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
+  taskComplete: {
+    args: {
+      workflowId: tool.schema.string(),
+      taskId: tool.schema.string(),
+      moreTasks: tool.schema.boolean(),
+      nextTaskId: tool.schema.string().optional(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createTaskCompleteTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
+  finalReview: {
+    args: {
+      workflowId: tool.schema.string(),
+      axis: tool.schema.enum(["standards", "spec"]),
+      verdict: tool.schema.enum(["pass", "fail", "blocked"]),
+      headSha: tool.schema.string(),
+      mergeBaseSha: tool.schema.string(),
+      packageHash: tool.schema.string(),
+      submittedBy: tool.schema.string(),
+      findings: tool.schema.array(tool.schema.unknown()).optional(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createFinalReviewTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
+  skillDiscover: {
+    args: {
+      query: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createSkillDiscoverTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
+  skillInstall: {
+    args: {
+      package: tool.schema.string(),
+      skillName: tool.schema.string(),
+      worktreePath: tool.schema.string(),
+      version: tool.schema.string().optional(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createSkillInstallTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
+  skillAudit: {
+    args: {
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createSkillAuditTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
+  skillUninstall: {
+    args: {
+      skill: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createSkillUninstallTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
   planSubmit: {
     args: {
       workflowId: tool.schema.string(),
@@ -17190,7 +18216,8 @@ var factories = {
     },
     build: (rt) => createTaskReviewTool({
       repoRoot: rt.repoRoot,
-      owner: rt.owner
+      owner: rt.owner,
+      config: rt.configValue
     })
   },
   resume: {