opencode-ship 1.1.2-rc.2 → 1.1.2

package/CHANGELOG.md

@@ -2,7 +2,102 @@
 
 All notable changes to `opencode-ship` are recorded here.
 
-## 1.1.2-rc.2 — Complete contract correction
+## 1.1.2 — Stable: Plan Mode write access
+
+> Branch: `release/1.1.2`. Promoted from `1.1.2-rc.4` after dogfood.
+
+- **Plan Mode write access for brainstorming / writing-plans products.**
+  The installer now owns two leaf pointers under
+  `agent.plan.permission` so OpenCode's Plan mode can write its
+  brainstorming / writing-plans / wayfinder output:
+
+  - `/agent/plan/permission/edit/docs/superpowers/**` = `allow`
+  - `/agent/plan/permission/edit/.git/opencode-ship/plans/**` = `allow`
+
+  The whole `/agent/plan/permission` block is still consumer-owned;
+  the installer only owns these two glob leaves. When the consumer
+  previously declared `agent.plan.permission.edit` as a scalar
+  string (e.g. `"deny"`), the installer promotes it to
+  `{ "*": <scalar>, ... }` on install and records the previous
+  scalar so uninstall can restore it byte-for-byte. A consumer
+  that explicitly sets `docs/superpowers/**: "deny"` is a
+  fail-closed conflict.
+
+- **Full self-hosting contract corrections** carried over from
+  `1.1.2-rc.3`: durable plan store, Plan Mode permission
+  consumer-ownership, workflow state machine coverage, parallel
+  Standards/Spec Ready gate, trusted-auto skill discovery, and the
+  `/setup-ship-workflow` single-skill contract. See the
+  `1.1.2-rc.*` entries below for the bounded evidence ledger.
+
+## 1.1.2-rc.3 — Complete contract correction (round 2)
+
+> Branch: `fix/1.1.2-rc.3-contract`.
+> Tracker: https://github.com/Viktorxyz/opencode-ship/issues/56.
+
+`1.1.2-rc.2` shipped green CI but its CHANGELOG claimed more than the
+codebase delivered: the B2 dispatch work stayed on an unmerged branch,
+the B4 matrix was wired but the per-leaf pointer records were not
+written by `init`, the B5 setup-complete command cleared the
+setup-pending marker BEFORE validating the artifacts (so a failed
+validation lost the marker with no compensating lock write), and the
+B7 trusted-skill install wrote a placeholder `SKILL.md` whose hash
+matched the inventory by construction.
+
+This release corrects those gaps and ships only what is true at the
+byte level:
+
+- **`ship_skill_install`** materialises real bytes via the public
+  `skills` CLI pinned to a known version, copies them through a
+  staging directory, hashes every installed file, and verifies the
+  on-disk bytes match the staged bytes before appending to the
+  inventory. The tool fails closed when the CLI is unavailable; no
+  placeholder `SKILL.md` is ever written.
+- The inventory is now append-only schema v2 with a hash-chained
+  event log. Install events carry per-file sha256 + provenance
+  (registry snapshot, cli package, registryId); uninstall events
+  append a tombstone that references the install hash and never
+  splices the chain.
+- `ship_skill_install` validates the destination worktree via
+  `git worktree list --porcelain -z`. It refuses the main checkout,
+  unregistered paths, symlink traversal, and any destination whose
+  ancestor is a symlink. Paths that lexically contain `..` or
+  absolute segments are refused at append time.
+- The root permission matrix is the single source of truth.
+  `desiredPointersForProfile("engineering")` derives its pointer
+  list from `rootPermissionMatrix()` (no parallel `POINTER_ENTRIES`
+  list); the wildcard `*` default is never serialised as a literal
+  pointer, and bash policy is left to the OpenCode runtime instead
+  of being installer-owned state. Empty intermediate containers
+  (`agent.<name>.permission: {}`) are pruned on install/uninstall so
+  byte-identical restoration holds for empty consumer configs.
+- `setup-complete` validates lock, models, docs, and AGENTS.md
+  BEFORE any writes. The setup-pending marker is no longer part of
+  the gate (it is a chat-time signal, not an artifact). When the
+  gate passes, the lock is written with `setupComplete: true` and
+  the marker is cleared as part of the same commit. When validation
+  fails, no state changes.
+- The 32-tool public surface is unchanged. The eight new tools
+  (`ship_task_start`, `ship_task_commit`, `ship_task_complete`,
+  `ship_final_review`, `ship_skill_discover`, `ship_skill_install`,
+  `ship_skill_audit`, `ship_skill_uninstall`) are still first-class.
+- Regressions covered by new test suites: `tests/skills/install.test.mjs`,
+  `tests/skills/inventory.test.mjs`, `tests/skills/worktree.test.mjs`,
+  `tests/installer/root-permission-matrix.test.mjs`,
+  `tests/installer/setup-pending.test.mjs` (extended).
+
+## 1.1.2-rc.2 — Rejected, incomplete
+
+`1.1.2-rc.2` is published on npm `next` but is rejected as an
+incomplete candidate. The CHANGELOG for that release claimed
+behavior the source tree did not contain: the B2 dispatch work
+lived only on the unmerged branch `fix/1.1.2-rc.2-contract`, the
+root permission matrix was dead-code (POINTER_ENTRIES was the
+active source), the setup-complete command cleared the marker
+before validating, and `ship_skill_install` wrote a placeholder
+`SKILL.md` whose hash matched the inventory by construction. The
+published `1.1.2-rc.2` tarball is byte-equivalent to this rejected
+release.
 
 > Active stabilization branch: `fix/1.1.2-self-hosting`.
 > Parent tracker: https://github.com/Viktorxyz/opencode-ship/issues/56.

package/README.md

@@ -2,7 +2,7 @@
 
 > npm-distributed OpenCode installer and delivery plugin: a single command materialises the lifecycle plugin, reviewer/verifier agents, and skills into any consumer repository, with a recoverable lock and never silently overwrites managed files.
 >
-> **Status:** `1.1.0` is on `npm dist-tag latest`. The `1.1.x` stabilization line (parent issue #40) is in progress on the `fix/1.1.1-stabilization` branch. When `1.1.1` ships it becomes the first self-hosting release and `1.1.0` is deprecated. The `release/1.1.0-engineering-only` branch ships the engineering profile directly without a separate `core` profile. The `1.1.0` tag is immutable; consumers should use `opencode-ship@1.1.0` today and switch to `opencode-ship@1.1.1` once it is promoted to `latest`. See `docs/release/1.1.1-stabilization-plan.md` for the authoritative plan and issue #40 for the bounded evidence ledger.
+> **Status:** `1.1.2` is on `npm dist-tag latest` and is the first fully self-hosting release. It is the accepted successor of `1.1.1` (now deprecated). The `1.1.2 stabilization` line carried three rejected RCs (`1.1.2-rc.1`, `1.1.2-rc.2`, `1.1.2-rc.3`) before the stable candidate `1.1.2-rc.4` was promoted; see `docs/release/1.1.2-correction-plan.md` for the authoritative plan and issue #56 for the bounded evidence ledger. The `1.1.0` tag is immutable. Consumers of `opencode-delivery@0.1.x` should run `pnpm dlx opencode-ship@latest init` from the same checkout; migration recognises the legacy artifacts and adopts them when their bytes match.
 >
 > Consumers should use `opencode-ship@1.1.0` (or `@latest`) until `1.1.1` ships. The previous `1.0.0` is on `next`; consumers who pinned to `1.0.x` will continue to receive updates on that channel.
 
@@ -145,7 +145,7 @@ Existing consumers of `opencode-delivery@0.1.x` (commit-pinned shim) can run `pn
 
 ## Development
 
-`npm run verify` runs `format:check`, `lint`, `typecheck`, `build`, and the auto-discovered test suite. The tests cover the installer CLI, the lock and root-config planners, the catalog validator, the schema validator, agents, the packed-artifact smoke check, the transaction-recovery contract, the profile-resolution precedence chain, the catalog profile filter, the order-preserving root-config merge, the engineering↔core transition, the durable plan artifact, the Plan Mode permission integration, the M3 task loop contract (run store + task brief + Spec/Quality verdicts + 3-round breaker + commit binding + compaction context), the Ready gate (parallel GPT Standards/Spec + verifier + CI on one HEAD; Build cannot self-record), the transition matrix smoke (core omits engineering, engineering adds engineering, lock tracks the active profile), the static release-policy tests (Node matrix wiring, prerelease metadata, runtime-source digest wiring, 1.0 promotion policy), the runtime-source digest algorithm tests (deterministic across clean checkouts; ignores version and release-metadata changes; tracks every runtime-source modification), and the OpenCode live-server discovery smoke (24-tool canonical set exposed via `/experimental/tool/ids` on a real `opencode serve` instance for both `core` and `engineering` profiles). The suite count and per-test count are derived from the test runner at qualification time; this README intentionally does not lock in a specific test-count baseline.
+`npm run verify` runs `format:check`, `lint`, `typecheck`, `build`, and the auto-discovered test suite. The tests cover the installer CLI, the lock and root-config planners, the catalog validator, the schema validator, agents, the packed-artifact smoke check, the transaction-recovery contract, the profile-resolution precedence chain, the catalog profile filter, the order-preserving root-config merge, the engineering↔core transition, the durable plan artifact, the Plan Mode permission integration, the M3 task loop contract (run store + task brief + Spec/Quality verdicts + 3-round breaker + commit binding + compaction context), the Ready gate (parallel GPT Standards/Spec + verifier + CI on one HEAD; Build cannot self-record), the transition matrix smoke (core omits engineering, engineering adds engineering, lock tracks the active profile), the static release-policy tests (Node matrix wiring, prerelease metadata, runtime-source digest wiring, 1.0 promotion policy), the runtime-source digest algorithm tests (deterministic across clean checkouts; ignores version and release-metadata changes; tracks every runtime-source modification), and the OpenCode live-server discovery smoke (32-tool canonical set exposed via `/experimental/tool/ids` on a real `opencode serve` instance for both `core` and `engineering` fixtures). The suite count and per-test count are derived from the test runner at qualification time; this README intentionally does not lock in a specific test-count baseline.
 
 ```
 npm ci

package/THIRD_PARTY_NOTICES.md

@@ -1,6 +1,6 @@
 # Third-Party Notices
 
-`opencode-ship@1.1.2-rc.2` ships the complete Matt Pocock and Superpowers
+`opencode-ship@1.1.2` ships the complete Matt Pocock and Superpowers
 methodology under the MIT license, plus the Ship-owned installer,
 plugin, agents, and skills. The complete immutable pin list is in
 `vendor/sources.json`; the upstream snapshots are under

package/assets/agents/delivery-reviewer.md

@@ -4,6 +4,7 @@ mode: subagent
 temperature: 0.2
 steps: 8
 permission:
+  "*": deny
   edit: deny
   external_directory: deny
   webfetch: deny

package/assets/agents/delivery-verifier.md

@@ -4,6 +4,7 @@ mode: subagent
 temperature: 0.1
 steps: 8
 permission:
+  "*": deny
   edit: deny
   bash: deny
   external_directory: deny

package/assets/agents/ship-controller.md

@@ -5,6 +5,7 @@ temperature: 0.1
 model: <model-from-config>
 steps: 12
 permission:
+  "*": deny
   edit: deny
   external_directory: deny
   webfetch: deny
@@ -53,34 +54,46 @@ permission:
     "pnpm test *": allow
     "pnpm run verify *": allow
   task:
-    "*": allow
+    "*": deny
+    ship-planner: allow
+    ship-task-builder: allow
+    ship-task-reviewer: allow
+    ship-final-standards-reviewer: allow
+    ship-final-spec-reviewer: allow
+    delivery-verifier: allow
   delivery_inspect: allow
   delivery_issue: allow
   delivery_worktree: allow
-  delivery_verify: allow
+  delivery_verify: deny
   delivery_review: deny
   delivery_pr: allow
   delivery_ready: allow
-  delivery_merge: deny
+  delivery_merge: ask
   delivery_cleanup: allow
   delivery_github_read: allow
   delivery_issue_comment: allow
   delivery_issue_labels: allow
   delivery_issue_link: allow
-  delivery_issue_close: deny
+  delivery_issue_close: ask
   delivery_sync: allow
-  delivery_publish: deny
+  delivery_publish: allow
   ship_plan_start: allow
-  ship_plan_submit: allow
-  ship_plan_approve: deny
+  ship_plan_submit: deny
+  ship_plan_approve: ask
   ship_run_start: allow
+  ship_task_start: allow
+  ship_task_commit: allow
+  ship_task_complete: allow
   ship_task_report: deny
   ship_task_review: deny
+  ship_final_review: deny
   ship_resume: allow
   ship_status: allow
   ship_deliver: allow
   ship_skill_discover: allow
   ship_skill_install: allow
+  ship_skill_audit: allow
+  ship_skill_uninstall: allow
 ---
 
 # ship-controller

package/assets/agents/ship-final-spec-reviewer.md

@@ -1,10 +1,11 @@
 ---
-description: Strong Spec final reviewer. Records the Spec axis of the final review through `delivery_review` with `axis: spec`. Independent of the Standards reviewer and the controller.
+description: Strong Spec final reviewer. Records the Spec axis through `ship_final_review`. Independent of the Standards reviewer and the controller.
 mode: subagent
 temperature: 0.2
 model: <model-from-config>
 steps: 10
 permission:
+  "*": deny
   edit: deny
   external_directory: deny
   webfetch: deny
@@ -26,7 +27,7 @@ permission:
   delivery_issue: deny
   delivery_worktree: deny
   delivery_verify: deny
-  delivery_review: allow
+  delivery_review: deny
   delivery_pr: deny
   delivery_ready: deny
   delivery_merge: deny
@@ -37,6 +38,7 @@ permission:
   ship_run_start: deny
   ship_task_report: deny
   ship_task_review: deny
+  ship_final_review: allow
   ship_resume: deny
   ship_status: deny
   ship_deliver: deny
@@ -70,7 +72,7 @@ refuses to mark Ready if either axis is missing or fails.
 2. Score the Spec axis against the contract above. Every
    acceptance criterion the plan promised must be
    demonstrable from the final HEAD.
-3. Call `delivery_review` exactly once with
+3. Call `ship_final_review` exactly once with
    `axis: "spec"`, the merge-base SHA, the HEAD SHA, the
    package hash, and a single verdict. The verdict is
    `pass` only when every Spec criterion is met; any

package/assets/agents/ship-final-standards-reviewer.md

@@ -1,10 +1,11 @@
 ---
-description: Strong Standards final reviewer. Records the Standards axis of the final review through `delivery_review` with `axis: standards`. Independent of the Spec reviewer and the controller.
+description: Strong Standards final reviewer. Records the Standards axis through `ship_final_review`. Independent of the Spec reviewer and the controller.
 mode: subagent
 temperature: 0.2
 model: <model-from-config>
 steps: 10
 permission:
+  "*": deny
   edit: deny
   external_directory: deny
   webfetch: deny
@@ -26,7 +27,7 @@ permission:
   delivery_issue: deny
   delivery_worktree: deny
   delivery_verify: deny
-  delivery_review: allow
+  delivery_review: deny
   delivery_pr: deny
   delivery_ready: deny
   delivery_merge: deny
@@ -37,6 +38,7 @@ permission:
   ship_run_start: deny
   ship_task_report: deny
   ship_task_review: deny
+  ship_final_review: allow
   ship_resume: deny
   ship_status: deny
   ship_deliver: deny
@@ -66,7 +68,7 @@ to mark Ready if either axis is missing or fails.
    you. The package includes the task-by-task commits, the
    verification report, the CI report, and the manifest.
 2. Score the Standards axis against the contract above.
-3. Call `delivery_review` exactly once with
+3. Call `ship_final_review` exactly once with
    `axis: "standards"`, the merge-base SHA, the HEAD SHA,
    the package hash, and a single verdict. The verdict is
    `pass` only when every Standards criterion is met; any

package/assets/agents/ship-planner.md

@@ -5,6 +5,7 @@ temperature: 0.3
 model: <model-from-config>
 steps: 10
 permission:
+  "*": deny
   edit: deny
   external_directory: deny
   webfetch: deny

package/assets/agents/ship-task-builder.md

@@ -5,6 +5,7 @@ temperature: 0.2
 model: <model-from-config>
 steps: 8
 permission:
+  "*": deny
   edit: allow
   external_directory: deny
   webfetch: deny

package/assets/agents/ship-task-reviewer.md

@@ -5,6 +5,7 @@ temperature: 0.2
 model: <model-from-config>
 steps: 8
 permission:
+  "*": deny
   edit: deny
   external_directory: deny
   webfetch: deny