opencode-ship 1.1.7 → 1.1.8

package/CHANGELOG.md

@@ -2,7 +2,21 @@
 
 All notable changes to `opencode-ship` are recorded here.
 
-## 1.1.7 — Stabilization and self-hosting (unreleased)
+## 1.1.8 — Durable self-host routing correction (unreleased)
+
+- **Deterministic controller entrypoint.** Build calls `ship_deliver` to
+  dispatch one `ship-controller` session per issue. Schema-v2 worktrees
+  refuse implementation until the durable workflow is linked.
+- **Linked-worktree execution.** Builder, task review, commit verification,
+  verifier/CI binding, and dual-axis final review run in the registered
+  feature worktree while durable state stays in the Git common directory.
+- **Audited abandon.** `delivery_abandon` records immutable intent and
+  completion around CAS-safe cleanup of a closed, unmerged attempt. It
+  never closes a PR and never marks Ready.
+- Automated install, qualification, and rollout continue to pin exact
+  `opencode-ship@<X.Y.Z>` and never resolve `@latest`.
+
+## 1.1.7 — Stabilization and self-hosting
 
 > Baseline: https://github.com/Viktorxyz/opencode-ship/issues/70.
 > Corrective package: https://github.com/Viktorxyz/opencode-ship/issues/72.

package/README.md

@@ -2,9 +2,9 @@
 
 > npm-distributed OpenCode installer and delivery plugin: a single command materialises the lifecycle plugin, reviewer/verifier agents, and skills into any consumer repository, with a recoverable lock and never silently overwrites managed files.
 >
-> **Status:** `1.1.5` is the current `npm dist-tag latest`. It makes the `ship-plan` primary planning agent product-only: the agent asks about the product, writes `.opencode/plans/*.md`, and stops without leaking delivery-workflow choices into the planning conversation. The immutable tag `1.1.6` failed in `pack` before npm publish or GitHub Release; no npm package or GitHub Release was created. `1.1.7` is the active unpublished correction, tracked by the authoritative [`docs/release/1.1.6-correction-plan.md`](docs/release/1.1.6-correction-plan.md).
+> **Status:** `1.1.7` is the published stabilization and self-hosting correction. The immutable tag `1.1.6` failed in `pack` before npm publish or GitHub Release; no npm package or GitHub Release was created. `1.1.8` is the unpublished durable-routing correction: Build dispatches `ship_deliver`, schema-v2 execution binds to the linked worktree, and closed unmerged attempts can be abandoned with `delivery_abandon`. See [`docs/release/1.1.6-correction-plan.md`](docs/release/1.1.6-correction-plan.md).
 >
-> Use an exact package version for reproducible installs and all self-hosting work. Until `1.1.7` is published and qualified, the verified stable pin is `opencode-ship@1.1.5`; never resolve `@latest` inside an automated release or self-host update.
+> Use an exact package version for reproducible installs and all self-hosting work. Never resolve `@latest` inside an automated release or self-host update. Prerelease candidates publish under `npm dist-tag next` until qualification promotes a stable pin.
 
 ---
 
@@ -158,7 +158,7 @@ The shipped artifact is built by esbuild (`scripts/build.mjs`); self-contained `
 ## Status and licensing
 
 - **License:** MIT. See `LICENSE`.
-- **Versioning:** SemVer. v0.2.0 is the first npm-distributed release. v0.3.0 is the installer foundation. v0.4.0 adds the profile-aware installer foundation (`--profile` flag, lock schema v2, profile precedence) that issue #18 requires. v0.5.0 ships the engineering profile content (triage + grill-with-docs SKILL.md placeholders) required by issue #20. v0.6.0 ships the durable plan artifact + Plan Mode permission integration required by issue #21. v0.7.0 ships the M3 task loop contract (run store, task brief, Spec/Quality verdicts, 3-round breaker, commit binding, compaction context) required by issue #22. v0.8.0 ships the Ready gate contract (parallel Standards/Spec + verifier + CI on one HEAD) required by issue #23. v0.9.0 ships the transition matrix smoke (engineering installs all assets, lock tracks the active profile) required by issue #24. v1.0.0 promotes the dogfooded 0.10.0 to stable. v1.1.0 removes the legacy core profile and ships the one-liner init + setup-ship-workflow skill. v1.1.1 began the self-hosting correction line; the immutable `1.1.6` failed before publication and `1.1.7` is the planned unpublished correction (see `docs/release/1.1.6-correction-plan.md`).
+- **Versioning:** SemVer. v0.2.0 is the first npm-distributed release. v0.3.0 is the installer foundation. v0.4.0 adds the profile-aware installer foundation (`--profile` flag, lock schema v2, profile precedence) that issue #18 requires. v0.5.0 ships the engineering profile content (triage + grill-with-docs SKILL.md placeholders) required by issue #20. v0.6.0 ships the durable plan artifact + Plan Mode permission integration required by issue #21. v0.7.0 ships the M3 task loop contract (run store, task brief, Spec/Quality verdicts, 3-round breaker, commit binding, compaction context) required by issue #22. v0.8.0 ships the Ready gate contract (parallel Standards/Spec + verifier + CI on one HEAD) required by issue #23. v0.9.0 ships the transition matrix smoke (engineering installs all assets, lock tracks the active profile) required by issue #24. v1.0.0 promotes the dogfooded 0.10.0 to stable. v1.1.0 removes the legacy core profile and ships the one-liner init + setup-ship-workflow skill. v1.1.1 began the self-hosting correction line; the immutable `1.1.6` failed before publication, `1.1.7` is the published stabilization correction, and `1.1.8` is the unpublished durable-routing correction (see `docs/release/1.1.6-correction-plan.md`).
 - **Compatibility:** the bundled plugin targets `@opencode-ai/plugin >= 1.15.5 < 2` and OpenCode `>= 1.15.5`.
 
 ## FAQ

package/THIRD_PARTY_NOTICES.md

@@ -1,6 +1,6 @@
 # Third-Party Notices
 
-`opencode-ship@1.1.7` includes the complete Matt Pocock and Superpowers
+`opencode-ship@1.1.8` includes the complete Matt Pocock and Superpowers
 methodology under the MIT license, plus the Ship-owned installer,
 plugin, agents, and skills. The complete immutable pin list is in
 `vendor/sources.json`; the upstream snapshots are under

package/assets/agents/ship-controller.md

@@ -75,6 +75,7 @@ permission:
   delivery_issue_labels: allow
   delivery_issue_link: allow
   delivery_issue_close: ask
+  delivery_abandon: ask
   delivery_sync: allow
   delivery_publish: allow
   ship_plan_start: allow
@@ -89,7 +90,7 @@ permission:
   ship_final_review: deny
   ship_resume: allow
   ship_status: allow
-  ship_deliver: allow
+  ship_deliver: deny
   ship_skill_discover: allow
   ship_skill_install: allow
   ship_skill_audit: allow
@@ -118,11 +119,13 @@ strong planner and task reviewer child sessions.
 5. On the final task, dispatch the parallel Standards + Spec
    final reviewers against the same HEAD, run the verifier
    in an independent session, and bind every gate to one HEAD.
-6. On explicit user request, run the merge with a fresh gate
-   recheck.
-7. On resume, reconcile the durable state with the live Git
-   state and never duplicate work already recorded in a
-   commit trailer.
+  6. On explicit user request, run the merge with a fresh gate
+     recheck.
+  7. On resume, reconcile the durable state with the live Git
+     state and never duplicate work already recorded in a
+     commit trailer.
+  8. After the user explicitly closes an unmerged PR and requests
+     abandon, call `delivery_abandon`. Never close the PR yourself.
 
 ## What you never do
 

package/assets/commands/ship-deliver.md

@@ -1,5 +1,5 @@
 ---
-description: Start a delivery workflow. First checks the setup-pending marker, runs skill discovery, then triggers planning with the same-HEAD Ready and merge gates.
+description: Start a delivery workflow. First checks the setup-pending marker, then dispatches the durable ship-controller through ship_deliver.
 ---
 
 # ship-deliver
@@ -25,31 +25,23 @@ If the marker is present:
 
 If the marker is absent, continue.
 
-### 1. Skill discovery (mandatory)
+### 1. Dispatch the controller
 
-Before dispatching the planner, run the `skill-discovery` skill:
+Call `ship_deliver` with the issue number. Do not implement the issue through the legacy `delivery_issue` / `delivery_worktree` / `delivery_pr` path.
 
-```text
-npx skills find "<query from issue/plan>"
-```
-
-Auto-install trusted sources (see `ship.config.json#skillDiscovery.trustedOwners`); present non-trusted candidates to the user. Limit to 5 auto-installs per dispatch.
+1. Check setup-pending.
+2. Call `ship_deliver(issueNumber)`.
+3. Surface the controller session and `wf-<issue>` workflow id.
+4. Await the explicit plan approval prompt.
+5. Resume only through `ship-controller`.
 
 ### 2. Plan + approve
 
-1. Resolve or restore workflow state from `<git-common-dir>/opencode-ship/`.
-2. Dispatch the strong planner (`openai/gpt-5.6-sol` by default) to produce a PlanV2 contract.
-3. Wait for `ship_plan_approve` from the user. Never auto-approve.
-4. Mirror the plan to the issue.
+The controller starts or resumes durable workflow state, dispatches the planner, and waits for `ship_plan_approve`. Never auto-approve.
 
 ### 3. Execute
 
-Drive each task through:
-
-- cheap builder (`minimax/MiniMax-M3` by default) — implement + report
-- task reviewer (Spec + Quality) — verdict
-- controller commit + push
-- same-HEAD gate: Standards + Spec final reviews, verifier, required CI
+The controller drives each task through the cheap builder, task reviewer, commit binding, and same-HEAD Standards + Spec + verifier + required CI gates.
 
 ### 4. Ready
 
@@ -57,27 +49,20 @@ Stop at Ready. Surface PR URL, worktree path, verifier SHA, and the explicit-mer
 
 ### 5. Merge
 
-On explicit `merge it`: fresh gate recheck, squash merge, cleanup, core downgrade, uninstall, root-config byte restoration.
+On explicit `merge it`: fresh gate recheck, squash merge, and cleanup.
 
 ## Hard rules
 
 - **Never skip the setup gate.** If the marker is present, refuse to plan.
-- **Never skip skill discovery.** The discovery is part of the autonomous-uplift contract.
 - **Never auto-approve a plan.** The user always reviews the plan.
 - **Never mark Ready or merge without a passing Standards review, a passing Spec review, a passing verifier run, and a passing required-CI check, all bound to one HEAD.**
 - **Never force-push, hard-reset, stash, or `git worktree remove`.**
 - **Never use `gh api` or raw shell on GitHub.** Use the typed `delivery_*` tools.
-
-## Single-shot research checkpoint
-
-If you decide the task is non-trivial, pause once and **ask the user** whether to run Deep Research before generating any prompt. The default save-tokens path is "no research, continue with the plan as written". Only on explicit "yes" do you generate a draft Deep Research prompt and run the research; summarize the relevant findings inline and continue. Do not write to `docs/research/` unless the findings materially shape an ADR; ADR storage is the project's call, not yours. Continue only after the user confirms or declines.
-
-The full procedure lives in the `planning-research-checkpoint` skill. Do not duplicate the prompt-generation logic here — just trigger the skill and respect its ask-first policy.
+- **Never abandon an attempt without an explicit user request after the PR is closed unmerged.** The controller may then call `delivery_abandon`.
 
 ## Stop conditions
 
 - Setup pending: stop, run setup, then re-dispatch.
 - Ready reached: stop. Surface the PR URL, the worktree path, the recorded verifier SHA, and the explicit-merge instruction.
-- `merge it` requested and gates are fresh: perform the squash merge. Surface the merge SHA. The plugin will queue immediate cleanup; if cleanup fails it is recorded as `cleanupPending` and retried on the next Build task.
+- `merge it` requested and gates are fresh: perform the squash merge. Surface the merge SHA.
 - Any gate fails after one re-run: stop. Surface the failing tool, the failing input, and the recorded evidence.
-- Unexpected lifecycle error (missing-manifest, head-changed, ci-failing): stop. Surface the error envelope.

package/assets/skills/delivery-workflow/SKILL.md

@@ -5,7 +5,7 @@ description: Orchestrates the canonical delivery lifecycle from issue creation t
 
 # delivery-workflow
 
-You drive the opencode-ship package from a one-line user request to a green, conflict-free, ready-to-merge pull request.
+You drive the opencode-ship package from a one-line user request to a green, conflict-free, ready-to-merge pull request by dispatching the durable controller.
 
 ## When you trigger
 
@@ -17,6 +17,7 @@ You drive the opencode-ship package from a one-line user request to a green, con
 - "Clean up my worktree" / "Tidy old worktrees" — entry point for next-task cleanup
 
 Do **not** trigger on:
+
 - Read-only questions ("explain issue N")
 - Plain chat about the project's domain model
 - Typo / doc one-liners that do not deserve a PR
@@ -25,40 +26,32 @@ Do **not** trigger on:
 
 | Step | Tool | Notes |
 |---|---|---|
-| 1. Cleanup old worktrees | `delivery_inspect` for each manifest, recovery scan, `delivery_cleanup` for provably-merged ones | Runs immediately after a successful merge; retries on next Build task if interrupted |
-| 2. Offer research checkpoint | (this skill) | Single-shot per session; offer only if the plan is non-trivial |
-| 3. Find or create the issue | `delivery_issue` | Always idempotent; never create a duplicate |
-| 4. Create a worktree | `delivery_worktree` | Refuse overwrites; refuse dirty tree |
-| 5. Implement | (consumer-owned) | Stay inside the worktree |
-| 6. Commit + push | (consumer-owned `git`) | Use Conventional Commits |
-| 7. Open draft PR | `delivery_pr` | `Closes #N` is added automatically |
-| 8. Sync with default branch | (consumer-owned `git`) | Merge `origin/main` into the feature branch; never rebase a published branch |
-| 9. Review | `task reviewer:delivery-reviewer` | Re-run if HEAD changed |
-| 10. Verify | `task verifier:delivery-verifier` | Same final HEAD required |
-| 11. Mark Ready | `delivery_ready` | Refreshes checks; refuses if any gate is stale |
-| 12. Stop at Ready | (this skill) | Do not merge without an explicit user request |
-| 13. Merge (only on explicit request) | `delivery_merge` | Re-checks base, head, and mergeability |
-| 14. Immediate cleanup | `delivery_cleanup` | Runs automatically right after a successful merge |
+| 1. Cleanup merged worktrees | `delivery_inspect` / `delivery_cleanup` | Only for provably merged attempts |
+| 2. Setup gate | `/ship-deliver` | Refuse if `.opencode/ship.setup-pending.json` exists |
+| 3. Dispatch controller | `ship_deliver` | Canonical Build-to-controller entrypoint |
+| 4. Plan + approve | controller / `ship_plan_approve` | Never auto-approve |
+| 5. Execute in linked worktree | controller | Builder, task review, commit, verifier, CI, dual-axis final review |
+| 6. Ready | `delivery_ready` | Controller-owned; same-HEAD gates required |
+| 7. Stop at Ready | (this skill) | Do not merge without an explicit user request |
+| 8. Merge | `delivery_merge` | Explicit user request only |
+| 9. Cleanup | `delivery_cleanup` | After a successful merge |
+| 10. Abandon closed unmerged attempts | `delivery_abandon` | Only after the user explicitly closes the PR and requests abandon |
+
+Do not call `delivery_worktree`, `delivery_pr`, `delivery_ready`, or `delivery_merge` from Build to implement an issue. Those mutations belong to `ship-controller` after `ship_deliver`.
 
 ## Hard rules
 
-1. Every PR carries a `Closes #N` reference. If the issue does not exist, create it first.
+1. Every PR carries a `Closes #N` reference. If the issue does not exist, the controller creates it first.
 2. The lifecycle stops at Ready by default. An explicit "merge it" is the only thing that triggers `delivery_merge`.
-3. Force-push, hard-reset, stash, and `git worktree remove` are denied to you. Use `delivery_worktree` and `delivery_cleanup` instead.
+3. Force-push, hard-reset, stash, and `git worktree remove` are denied. Use typed cleanup/abandon tools.
 4. You never edit `main` directly. You never bypass the reviewer/verifier gates.
-5. The typed `delivery_*` tools are the only sanctioned way to mutate GitHub state. Do not invoke `gh pr merge`, `gh api`, or raw Git plumbing directly.
+5. The typed tools are the only sanctioned way to mutate GitHub state. Do not invoke `gh pr merge`, `gh api`, or raw Git plumbing directly.
 6. When a gate fails, fix the cause and re-run only the failed gate; never skip.
 7. If `delivery_merge` returns a `MergeError`, surface it verbatim. Do not invent a workaround.
 
-## Single-shot research checkpoint
-
-If you decide the task is non-trivial, pause once and **ask the user** whether to run Deep Research before generating any prompt. The default save-tokens path is "no research, continue with the plan as written". Only on explicit "yes" do you generate a draft Deep Research prompt and run the research; summarize the relevant findings inline and continue. Do not write to `docs/research/` unless the findings materially shape an ADR; ADR storage is the project's call, not yours. Continue only after the user confirms or declines.
-
-The full procedure lives in the `planning-research-checkpoint` skill. Do not duplicate the prompt-generation logic here — just trigger the skill and respect its ask-first policy.
-
 ## Stop conditions
 
 - Ready reached: stop. Surface the PR URL, the worktree path, the recorded verifier SHA, and the explicit-merge instruction.
-- `merge it` requested and gates are fresh: perform the squash merge. Surface the merge SHA. The plugin will queue immediate cleanup; if cleanup fails it is recorded as `cleanupPending` and retried on the next Build task.
+- `merge it` requested and gates are fresh: perform the squash merge. Surface the merge SHA.
 - Any gate fails after one re-run: stop. Surface the failing tool, the failing input, and the recorded evidence.
-- Unexpected lifecycle error (missing-manifest, head-changed, ci-failing): stop. Surface the error envelope.
+- Unexpected lifecycle error (missing-manifest, missing-workflow-link, head-changed, ci-failing): stop. Surface the error envelope.

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// opencode-ship CLI v1.1.7
+// opencode-ship CLI v1.1.8
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -110,7 +110,7 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 var PACKAGE_VERSION, TEMPLATE_SET;
 var init_version = __esm({
   "src/version.js"() {
-    PACKAGE_VERSION = "1.1.7";
+    PACKAGE_VERSION = "1.1.8";
     TEMPLATE_SET = `v${PACKAGE_VERSION}`;
   }
 });
@@ -1769,6 +1769,7 @@ var CONTROLLER_TASK_ALLOW = [
   "delivery-verifier"
 ];
 var PUBLIC_TOOL_IDS = [
+  "delivery_abandon",
   "delivery_cleanup",
   "delivery_github_read",
   "delivery_inspect",
@@ -1785,6 +1786,7 @@ var PUBLIC_TOOL_IDS = [
   "delivery_sync",
   "delivery_verify",
   "delivery_worktree",
+  "ship_deliver",
   "ship_final_review",
   "ship_plan_approve",
   "ship_plan_start",
@@ -1809,6 +1811,7 @@ var BUILD_TOOL_ALLOW = [
   "delivery_pr",
   "delivery_ready",
   "delivery_worktree",
+  "ship_deliver",
   "ship_status",
   "ship_resume"
 ];
@@ -1816,6 +1819,7 @@ var BUILD_TOOL_ASK = [
   "ship_plan_approve",
   "delivery_merge",
   "delivery_issue_close",
+  "delivery_abandon",
   "ship_skill_install"
 ];
 var CONTROLLER_TOOL_ALLOW = [
@@ -1846,7 +1850,8 @@ var CONTROLLER_TOOL_ALLOW = [
 var CONTROLLER_TOOL_ASK = [
   "ship_plan_approve",
   "delivery_merge",
-  "delivery_issue_close"
+  "delivery_issue_close",
+  "delivery_abandon"
 ];
 var H = "git";
 var RESET = "--hard";
@@ -5251,7 +5256,7 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profil
     manager: {
       schemaVersion: CURRENT_LOCK_SCHEMA,
       name: "opencode-ship",
-      version: "1.1.7",
+      version: "1.1.8",
       templateSet: TEMPLATE_SET_ID,
       profile: resolvedProfile,
       appliedAt: (/* @__PURE__ */ new Date()).toISOString(),

package/dist/core.d.ts

@@ -100,6 +100,7 @@ export interface PullRequestSummary {
   draft: boolean;
   mergeable: "MERGEABLE" | "CONFLICTING" | "UNKNOWN";
   mergeStateStatus: string;
+  state: "OPEN" | "CLOSED" | "MERGED" | "UNKNOWN";
   merged: boolean;
   mergedAt: string | null;
 }
@@ -330,6 +331,12 @@ export interface CleanupToolInput {
   taskId: string;
 }
 
+export interface AbandonToolInput {
+  taskId: string;
+  subject: string;
+  operationId?: string;
+}
+
 export type Envelope<TKind extends string, TData> = { kind: TKind } & TData;
 
 // ---------------------------------------------------------------------------
@@ -581,3 +588,14 @@ export declare function createCleanupTool(deps: BaseToolDeps): (input: CleanupTo
   | Envelope<"branch-delete-failed", { stderr: string }>
   | Envelope<"unsafe-cleanup", { signals: readonly string[] }>
 >;
+
+export declare function createAbandonTool(deps: BaseToolDeps): (input: AbandonToolInput) => Promise<
+  | { contractVersion: 2; ok: true; kind: "abandon"; operationId: string; idempotent: boolean; data: {
+    taskId: string;
+    intentHash: string;
+    removedWorktree: boolean;
+    deletedBranch: boolean;
+    deletedManifest: boolean;
+  } }
+  | { contractVersion: 2; ok: false; kind: "abandon"; operationId: string; retryable: boolean; message: string; details: { kind: string } }
+>;