openhermes 4.11.2 → 4.13.0

package/harness/lib/routing/routing.test.ts

@@ -0,0 +1,195 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { consumeRouteGuidance, parseSkillFrontmatter, resolveRoute } from "./index.ts";
+
+describe("routing frontmatter", () => {
+  it("parses scalar route values", () => {
+    const parsed = parseSkillFrontmatter(`---
+name: oh-test
+route:
+  pass: oh-builder
+  fail: oh-review
+  blocker: surface
+---`);
+
+    assert.ok(parsed);
+    assert.deepEqual(parsed.route, {
+      pass: ["oh-builder"],
+      fail: ["oh-review"],
+      blocker: ["surface"],
+    });
+  });
+
+  it("parses yaml route lists", () => {
+    const parsed = parseSkillFrontmatter(`---
+name: oh-test
+route:
+  pass:
+    - oh-gauntlet
+    - oh-ship
+  fail:
+    - oh-builder
+  blocker: surface
+---`);
+
+    assert.ok(parsed);
+    assert.deepEqual(parsed.route, {
+      pass: ["oh-gauntlet", "oh-ship"],
+      fail: ["oh-builder"],
+      blocker: ["surface"],
+    });
+  });
+
+  it("parses inline route arrays", () => {
+    const parsed = parseSkillFrontmatter(`---
+name: oh-test
+route:
+  pass: [oh-gauntlet, oh-ship]
+  fail: [surface, oh-expert]
+  blocker: surface
+---`);
+
+    assert.ok(parsed);
+    assert.deepEqual(parsed.route, {
+      pass: ["oh-gauntlet", "oh-ship"],
+      fail: ["surface", "oh-expert"],
+      blocker: ["surface"],
+    });
+  });
+});
+
+describe("resolveRoute", () => {
+  const route = {
+    pass: ["oh-gauntlet", "oh-ship"],
+    fail: ["oh-builder"],
+    blocker: ["surface"],
+  };
+
+  it("defaults to the first candidate for an outcome", () => {
+    const resolved = resolveRoute(route, { outcome: "pass" });
+    assert.deepEqual(resolved, {
+      outcome: "pass",
+      candidates: ["oh-gauntlet", "oh-ship"],
+      selected: "oh-gauntlet",
+      reason: 'Selected first declared route for outcome "pass".',
+    });
+  });
+
+  it("prefers an evidence target when it matches a candidate", () => {
+    const resolved = resolveRoute(route, { outcome: "pass", target: "oh-ship" });
+    assert.deepEqual(resolved, {
+      outcome: "pass",
+      candidates: ["oh-gauntlet", "oh-ship"],
+      selected: "oh-ship",
+      reason: 'Selected "oh-ship" from output evidence.',
+    });
+  });
+
+  it("prefers oh-ship for verified done ship work", () => {
+    const resolved = resolveRoute(route, {
+      outcome: "pass",
+      verification: "verified",
+      action: "done",
+      work: "ship",
+    });
+
+    assert.deepEqual(resolved, {
+      outcome: "pass",
+      verification: "verified",
+      action: "done",
+      work: "ship",
+      candidates: ["oh-gauntlet", "oh-ship"],
+      selected: "oh-ship",
+      reason: 'Selected "oh-ship" for verified ship-ready work.',
+    });
+  });
+
+  it("prefers oh-gauntlet for unverified work", () => {
+    const resolved = resolveRoute(route, {
+      outcome: "pass",
+      verification: "unverified",
+      action: "done",
+      work: "ship",
+    });
+
+    assert.deepEqual(resolved, {
+      outcome: "pass",
+      verification: "unverified",
+      action: "done",
+      work: "ship",
+      candidates: ["oh-gauntlet", "oh-ship"],
+      selected: "oh-gauntlet",
+      reason: 'Selected "oh-gauntlet" because work is still unverified.',
+    });
+  });
+
+  it("prefers oh-gauntlet for verify work", () => {
+    const resolved = resolveRoute(route, {
+      outcome: "pass",
+      verification: "verified",
+      action: "done",
+      work: "verify",
+    });
+
+    assert.deepEqual(resolved, {
+      outcome: "pass",
+      verification: "verified",
+      action: "done",
+      work: "verify",
+      candidates: ["oh-gauntlet", "oh-ship"],
+      selected: "oh-gauntlet",
+      reason: 'Selected "oh-gauntlet" for verification work.',
+    });
+  });
+
+  it("prefers oh-builder for fixable implementation work", () => {
+    const resolved = resolveRoute({
+      pass: ["oh-gauntlet", "oh-ship", "oh-builder"],
+      fail: ["oh-builder"],
+      blocker: ["surface"],
+    }, {
+      outcome: "pass",
+      verification: "verified",
+      action: "fixable",
+      work: "implement",
+    });
+
+    assert.deepEqual(resolved, {
+      outcome: "pass",
+      verification: "verified",
+      action: "fixable",
+      work: "implement",
+      candidates: ["oh-gauntlet", "oh-ship", "oh-builder"],
+      selected: "oh-builder",
+      reason: 'Selected "oh-builder" for fixable implementation work.',
+    });
+  });
+});
+
+describe("consumeRouteGuidance", () => {
+  it("promotes a selected route into an explicit next-route instruction", () => {
+    const consumed = consumeRouteGuidance([
+      "Review complete",
+      'ROUTE_GUIDANCE: {"outcome":"pass","candidates":["oh-gauntlet","oh-ship"],"selected":"oh-ship","reason":"Selected \\\"oh-ship\\\" from output evidence."}',
+    ].join("\n"));
+
+    assert.equal(consumed.selected, "oh-ship");
+    assert.match(consumed.output, /NEXT_ROUTE: oh-ship/);
+  });
+
+  it("leaves output unchanged when no route guidance is present", () => {
+    const output = "plain output";
+    const consumed = consumeRouteGuidance(output);
+
+    assert.equal(consumed.selected, null);
+    assert.equal(consumed.output, output);
+  });
+
+  it("ignores malformed route guidance safely", () => {
+    const output = 'Review complete\nROUTE_GUIDANCE: {"selected":42}';
+    const consumed = consumeRouteGuidance(output);
+
+    assert.equal(consumed.selected, null);
+    assert.equal(consumed.output, output);
+  });
+});

package/harness/lib/routing/skill-frontmatter.ts

@@ -0,0 +1,125 @@
+import fs from "node:fs";
+import type { RouteOutcome, SkillRouteMap, SkillRoutingFrontmatter } from "./types.ts";
+
+const EMPTY_ROUTES: SkillRouteMap = {
+  pass: [],
+  fail: [],
+  blocker: [],
+};
+
+function stripQuotes(value: string): string {
+  return value.trim().replace(/^['"]|['"]$/g, "");
+}
+
+function parseRouteValue(value: string): string[] {
+  const trimmed = value.trim();
+  if (!trimmed) return [];
+
+  if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+    return trimmed
+      .slice(1, -1)
+      .split(",")
+      .map((entry) => stripQuotes(entry))
+      .filter(Boolean);
+  }
+
+  return [stripQuotes(trimmed)].filter(Boolean);
+}
+
+function isRouteOutcome(value: string): value is RouteOutcome {
+  return value === "pass" || value === "fail" || value === "blocker";
+}
+
+export function extractFrontmatter(source: string): string | null {
+  const match = source.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+  return match?.[1] ?? null;
+}
+
+export function parseSkillFrontmatter(source: string): SkillRoutingFrontmatter | null {
+  const rawFrontmatter = extractFrontmatter(source);
+  if (!rawFrontmatter) return null;
+
+  const route: SkillRouteMap = {
+    pass: [],
+    fail: [],
+    blocker: [],
+  };
+
+  let name: string | undefined;
+  let description: string | undefined;
+  let tier: string | undefined;
+  let inRouteBlock = false;
+  let activeRouteKey: RouteOutcome | null = null;
+
+  for (const rawLine of rawFrontmatter.split(/\r?\n/)) {
+    const line = rawLine.trimEnd();
+    const trimmed = line.trim();
+
+    if (!trimmed) continue;
+
+    if (/^route:\s*$/.test(trimmed)) {
+      inRouteBlock = true;
+      activeRouteKey = null;
+      continue;
+    }
+
+    if (inRouteBlock) {
+      const routeMatch = line.match(/^\s{2,}(pass|fail|blocker):\s*(.*)$/);
+      if (routeMatch && isRouteOutcome(routeMatch[1])) {
+        activeRouteKey = routeMatch[1];
+        route[activeRouteKey].push(...parseRouteValue(routeMatch[2]));
+        continue;
+      }
+
+      const listMatch = line.match(/^\s{4,}-\s+(.+)$/);
+      if (listMatch && activeRouteKey) {
+        route[activeRouteKey].push(stripQuotes(listMatch[1]));
+        continue;
+      }
+
+      if (!/^\s/.test(line)) {
+        inRouteBlock = false;
+        activeRouteKey = null;
+      } else {
+        activeRouteKey = null;
+        continue;
+      }
+    }
+
+    const fieldMatch = line.match(/^(name|description|tier):\s*(.+)$/);
+    if (!fieldMatch) continue;
+
+    const value = stripQuotes(fieldMatch[2]);
+    switch (fieldMatch[1]) {
+      case "name":
+        name = value;
+        break;
+      case "description":
+        description = value;
+        break;
+      case "tier":
+        tier = value;
+        break;
+    }
+  }
+
+  return {
+    name,
+    description,
+    tier,
+    route,
+  };
+}
+
+export function readSkillFrontmatter(skillFilePath: string): SkillRoutingFrontmatter | null {
+  if (!fs.existsSync(skillFilePath)) return null;
+  return parseSkillFrontmatter(fs.readFileSync(skillFilePath, "utf8"));
+}
+
+export function emptySkillRoutes(): SkillRouteMap {
+  return {
+    pass: [...EMPTY_ROUTES.pass],
+    fail: [...EMPTY_ROUTES.fail],
+    blocker: [...EMPTY_ROUTES.blocker],
+  };
+}

package/harness/lib/routing/types.ts

@@ -0,0 +1,52 @@
+export const ROUTE_OUTCOMES = ["pass", "fail", "blocker"] as const;
+export const ROUTE_VERIFICATIONS = ["verified", "unverified"] as const;
+export const ROUTE_ACTIONS = ["done", "fixable", "needs-context", "blocked"] as const;
+export const ROUTE_WORK_TYPES = ["implement", "verify", "ship", "diagnose", "surface"] as const;
+
+export type RouteOutcome = (typeof ROUTE_OUTCOMES)[number];
+export type RouteVerification = (typeof ROUTE_VERIFICATIONS)[number];
+export type RouteAction = (typeof ROUTE_ACTIONS)[number];
+export type RouteWork = (typeof ROUTE_WORK_TYPES)[number];
+
+export interface SkillRouteMap {
+  pass: string[];
+  fail: string[];
+  blocker: string[];
+}
+
+export interface SkillRoutingFrontmatter {
+  name?: string;
+  description?: string;
+  tier?: string;
+  route: SkillRouteMap;
+}
+
+export interface RouteEvidence {
+  outcome: RouteOutcome;
+  verification?: RouteVerification;
+  action?: RouteAction;
+  work?: RouteWork;
+  target?: string;
+  reason?: string;
+}
+
+export interface RouteResolution {
+  outcome: RouteOutcome;
+  verification?: RouteVerification;
+  action?: RouteAction;
+  work?: RouteWork;
+  candidates: string[];
+  selected: string | null;
+  reason: string;
+}
+
+export interface RuntimeRouteDecision {
+  selected: string;
+  source: "next_route" | "route_guidance";
+  outcome?: RouteOutcome;
+  verification?: RouteVerification;
+  action?: RouteAction;
+  work?: RouteWork;
+  candidates?: string[];
+  reason?: string;
+}

package/harness/skills/oh-ascii/SKILL.md

@@ -19,7 +19,7 @@ Create and validate ASCII diagrams in three phases: design, generate, validate.
 3. Fence all diagrams in markdown code blocks
 4. Keep diagrams under 80 columns with max 3 nesting levels
 5. For complex diagrams, author PlantUML and render with `-utxt`
-6. Validate structural alignment with `scripts/check_ascii_alignment.py`
+6. Validate visual alignment manually: check that box-drawing characters connect cleanly and all columns align within the markdown code block
 7. Fix reported issues and re-validate until clean
 
 ## Routing

package/harness/skills/oh-fusion/DEEP.md

@@ -18,42 +18,57 @@ Confirm: content loaded, frontmatter present, no access restrictions. For multip
 
 ## Phase 2: Analysis
 
-### Depth Scoring
-| Metric | Assessment |
-|--------|-----------|
-| Lines | SKILL.md length |
-| Concrete rules | "must/never/always/banned" count |
-| Examples | Before/after or usage code blocks |
-| Anti-patterns | Explicit "don't" sections |
-| Workflow steps | Sequential, actionable steps |
-| Routing table | pass/fail/blocker defined |
+### Required Lenses
 
-**Score:** High (70-100) = concrete + examples + routing. Medium (30-69) = some structure. Low (0-29) = vague, no rules.
+Analyze every source through these lenses:
 
-### Overlap Detection
-Compare against existing `harness/skills/oh-*` skills. Overlap: none / partial (complementary) / complete (redundant).
+- **OH gaps** — what OH does not currently cover, or covers weakly
+- **OH wins** — where OH already outperforms the source and should not regress
+- **Missed patterns** — reusable patterns the source surfaces that OH should absorb
+- **Overlap target** — the strongest existing `oh-*` candidate for merge, if any
 
-### Convention Check
-- Clear description for triggering? Actionable instructions? Anti-patterns? Examples? Measurable outcomes? No time-sensitive refs? No platform assumptions?
+### Merge Rubric
 
-### Report Template
+Choose one verdict:
+
+| Verdict | Use when |
+|---------|----------|
+| Merge | The source upgrades an existing OH capability more than it defines a new one |
+| Standalone | The source adds a distinct capability with its own trigger, workflow, and routing needs |
+| Discard | The source is redundant, weak, or anti-native |
+
+### Strength Check
+
+Reject or rewrite any protocol that makes OH weaker, slower, noisier, or less OpenCode-native.
+
+### Fusion Report Template
 ```markdown
-**Depth:** <0-100> — <High/Medium/Low>
-**Overlap:** <existing skill> — <none/partial/complete>
-**Verdict:** <keep / fuse / discard / ask>
-**Action:** <port directly / fuse with X / discard>
+## OH gaps
+- ...
+
+## OH wins
+- ...
+
+## Missed patterns
+- ...
+
+## Merge verdict
+- Verdict: <merge | standalone | discard>
+- Target: <existing oh-* or new oh-*>
+- Why: <short rationale>
+
+## Action plan
+1. ...
+2. ...
+
+## Approval gate
+- Status: pending approval
+- Next move after approval: <skill/action>
 ```
 
 ## Phase 3: Decision
 
-| Verdict | Action |
-|---------|--------|
-| Keep | High signal, no overlap. Port to `oh-<name>`. |
-| Fuse | Partial overlap with existing. Merge complementary DNA. |
-| Discard | Low signal or complete overlap. Surface reasoning. |
-| Ask | Ambiguous quality. Surface findings. |
-
-When in doubt: prefer fuse over keep, keep over discard if ANY unique signal.
+Default to `merge` when the source sharpens an existing OH workflow. Default to `standalone` only when the capability stays clean, distinct, and reusable after removing overlap.
 
 ## Phase 4: Adaptation
 
@@ -65,10 +80,10 @@ tier: <2|3|4>
 ```
 
 ### Body Structure
-1. **Summary** — one-paragraph of what the skill does
+1. **Summary** — one short paragraph
 2. **When to Use** — clear triggering context
-3. **Workflow** — numbered steps (the core)
-4. **Anti-patterns** — what NOT to do
+3. **Protocol** — numbered workflow
+4. **Rubric / guardrails** — what to merge, reject, or escalate
 5. **Routing** — pass/fail/blocker table
 
 ### Adaptation Rules
@@ -78,11 +93,16 @@ tier: <2|3|4>
 - Keep all concrete rules, examples, and anti-patterns from the original.
 - Discard fluff, philosophy, and motivational language.
 - Preserve the original's unique signal — that's why you're importing it.
+- Keep the result OpenCode/OpenHermes-native only.
 
 ### Naming
 Match `^[a-z0-9]+(-[a-z0-9]+)*$`, prefix `oh-`. Original name if good fit, adapt if not. Fusion names signal combined purpose.
 
-## Phase 5: Fusion (opt — skip for single imports)
+## Phase 5: Approval Gate
+
+Before any harness mutation, surface the fusion report and wait for approval. Approved intent already present in the conversation counts. Do not ask new questions unless a blocker cannot be resolved from the codebase or prior conversation.
+
+## Phase 6: Fusion (opt — skip for single imports)
 
 For each skill being fused, identify:
 - **Unique concepts** — content only this skill has
@@ -101,7 +121,7 @@ Structure so each source contributes its strength. Do NOT concatenate — must r
 ### Naming
 Name signals combined purpose, not individual sources. E.g., `oh-facade` from redesign + design-taste + high-end-visual, not `oh-redesign-plus-taste`.
 
-## Phase 6: Integration
+## Phase 7: Integration
 
 1. **Create file** → user dir (`~/.config/opencode/skills/oh-<name>/SKILL.md`)
 2. **Wire AUTOPILOT** → add to auto-classify matrix in `harness/codex/AUTOPILOT.md`: signal keywords → classification → "Load **oh-<name>**. Do not ask."
@@ -113,8 +133,11 @@ Name signals combined purpose, not individual sources. E.g., `oh-facade` from re
 ## Anti-patterns
 
 - Importing without analysis (always run Phase 2)
-- Keeping everything — ~50% of external skills is fluff
+- Asking before checking code or prior conversation
+- Changing the harness before the approval gate clears
+- Keeping everything — most external skill text is fluff
 - Fusing incompatible domains (confusing to model and user)
 - Naming after source ("oh-tailwind-v2") instead of capability ("oh-styles")
 - Skipping route frontmatter — without it, autopilot can't route
 - Overwriting existing routing without checking for collisions
+- Shipping a protocol that weakens OH or makes it less native

package/harness/skills/oh-fusion/SKILL.md

@@ -3,34 +3,48 @@ name: oh-fusion
 description: "Use when the user has an existing skill, finds a skill in their .agents/skills, or wants to bring an external capability into OH as a skill."
 tier: 3
 route:
-  pass:
-    - oh-skills-link
-    - oh-skill-craft
-  fail: oh-skill-craft
+  pass: [oh-skill-craft, oh-skills-link]
+  fail: surface
   blocker: surface
 ---
 
 # oh-fusion
 
-Skill ingestion pipeline: Discover → Analyze → Decide → Adapt → Fuse → Integrate.
+Skill fusion pipeline: Discover → Analyze → Verdict → Approval Gate → Integrate.
 
-## Steps
+## Protocol
 
 1. Load skill content — read from `.agents/skills/`, `npx skills`, URL, user path, or inline text.
-2. Analyze depth — score by lines, concrete rules, examples, anti-patterns, workflow steps, and routing.
-3. Detect overlap — compare against existing `oh-*` skills. Report none/partial/complete.
-4. Decide verdict — Keep (high signal, no overlap), Fuse (partial overlap, merge DNA), Discard (low/no signal), or Ask (ambiguous).
-5. Adapt to OH-native format — remove emojis, convert paths, add routing, preserve unique signal.
-6. Fuse if merging — identify unique concepts from each source, resolve conflicts, write one coherent workflow.
-7. Integrate — create skill file, wire AUTOPILOT, routing, AGENTS.md, openhermes.md.
-8. Verify — route to oh-skills-link to confirm discovery.
+2. Analyze the source against OH — report `OH gaps`, `OH wins`, and `missed patterns`.
+3. Compare overlap — identify the best existing `oh-*` target, if any.
+4. Decide with a rubric:
+   - **Merge** when the source mainly strengthens an existing OH capability.
+   - **Standalone** when the source adds a distinct, reusable capability.
+   - **Discard** when the signal is weak or redundant.
+5. Produce a fusion report with these sections, in order:
+   - `OH gaps`
+   - `OH wins`
+   - `missed patterns`
+   - `merge verdict`
+   - `action plan`
+   - `approval gate`
+6. Resolve from code and prior conversation first. Ask only if a blocker remains.
+7. After approval, adapt to OH-native form and route directly to implementation.
+8. Verify discovery with `oh-skills-link` when a new or renamed skill is added.
+
+## Merge Rubric
+
+- **Merge into existing `oh-*`** when domain, trigger, and route already exist; the source mostly adds sharper rules, better sequencing, or stronger edge-case handling.
+- **Create standalone `oh-*`** when the source introduces a capability with distinct trigger words, workflow, and handoff points.
+- **Discard** when the source adds fluff, duplicates OH, or weakens OpenCode/OpenHermes-native operation.
 
 ## Routing
 
 | Outcome | Route |
 |---------|-------|
-| Integration complete | → oh-skills-link (verify discovery) |
-| Fusion needs iteration | → oh-skill-craft |
+| Approved merge or standalone plan | → oh-skill-craft |
+| New or renamed skill needs discovery check | → oh-skills-link |
 | Analysis: discard | → surface |
-| Analysis: ask | → surface with recs |
+| Approval not yet granted | → surface |
 | Blocker | → surface |
+

package/harness/skills/oh-init/DEEP.md

@@ -26,7 +26,7 @@ OpenHermes is the primary orchestrator. All routing, planning, and delegation fl
 - **Test command**: <fill or auto-detect>
 
 ## Key Directives
-- Plan first. Write to `~/.local/share/openhermes/plans/<project>/plan-<nnn>.md` before multi-file changes.
+- Plan first. Write to `~/.local/share/openhermes/plans/<project>/plan-<nnn>.md` before multi-file changes.
 - OpenHermes delegates everything to sub-agents — never executes directly.
 - Verify before claiming success. Read files, run commands, confirm output.
 - Use oh-* skills on demand via the skill tool.
@@ -40,7 +40,7 @@ Ask user to fill or auto-detect from manifests.
 ```markdown
 ## OpenHermes Orchestrator
 OpenHermes is the primary orchestrator.
-- **Plan**: `~/.local/share/openhermes/plans/<project>/plan-<nnn>.md`
+- **Plan**: `~/.local/share/openhermes/plans/<project>/plan-<nnn>.md`
 - **Never execute**: delegates everything to sub-agents
 - **Verify before claim**: read files, run commands, confirm output
 ```

package/harness/skills/oh-manifest/SKILL.md

@@ -29,3 +29,4 @@ Full build orchestration loop: pre-flight → plan → build → verify → loop
 | pass | → oh-planner |
 | fail | → oh-expert (diagnose loop failure) |
 | blocker | → surface with context and options |
+

package/harness/skills/oh-plan-review/DEEP.md

@@ -80,7 +80,7 @@ One section at a time: Architecture → Code Quality → Tests → Performance.
 
 ## Output
 
-Plan file (`~/.local/share/openhermes/plans/<project-name>/plan-<nnn>.md`) updated with findings and decisions.
+Plan file (`~/.local/share/openhermes/plans/<project-name>/plan-<nnn>.md`) updated with findings and decisions.
 
 ## Anti-patterns
 

package/harness/skills/oh-planner/DEEP.md

@@ -92,18 +92,18 @@ Runs sequentially: **Strategy → Architecture → Design → Engineering → DX
 Every plan written by oh-planner uses this canonical format.
 
 ### Storage
-Canonical path: `~/.local/share/openhermes/plans/<project>/plan-<nnn>.md`
+Canonical path: `~/.local/share/openhermes/plans/<project>/plan-<nnn>.md`
 
 ### Template
 ```markdown
 # PLAN: <project>
 
-Plan ID: <project>/plan-<nnn>
+Plan ID: <project>/plan-<nnn>
 Project: <project>
 Status: active | in-progress | blocked | complete | abandoned
 Created: <ts> | Updated: <ts>
 Project Path: <absolute-path>
-Plan Path: <canonical-path>/<project>/plan-<nnn>.md
+Plan Path: <canonical-path>/<project>/plan-<nnn>.md
 Objective: <short>
 
 ## Current State

package/harness/skills/oh-review/DEEP.md

@@ -23,6 +23,8 @@ AGENTS.md, CLAUDE.md, CONTRIBUTING.md, CONTEXT.md, ADRs, eslint/biome/prettier c
 ### 5. Aggregate
 Present under `## Standards` / `## Spec`. Do not merge. End with total + worst issue.
 
+Concrete, low-risk, fixable findings should be converted into implementation work and dispatched to oh-builder immediately instead of stopping as report-only notes.
+
 ### Safety Check (inline before spawning)
 - SQL injection, LLM trust boundary violations, conditional side effects (test vs prod), hardcoded secrets
 - Block immediately if critical — do not spawn sub-agents.

package/harness/skills/oh-review/SKILL.md

@@ -29,3 +29,4 @@ Two-axis review: Standards + Spec, parallel sub-agents. Three modes: Diff Review
 | pass | → oh-gauntlet or oh-ship |
 | fail | → oh-builder |
 | blocker | → surface |
+