orchestrator-workflow 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -0,0 +1,70 @@
+# Changelog
+
+All notable changes to `orchestrator-workflow` are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.7.1] - 2026-06-24
+
+### Security
+
+- The installed `reviewer` subagent now carries the same read-only tool posture
+  as the explorer: `disallowedTools: Edit, Write, NotebookEdit` (Claude Code) and
+  `permission: edit: deny` (opencode). Previously only the explorer was
+  tool-restricted and the reviewer was restrained by prose alone ("Do not rewrite
+  the change yourself"), so a misled or prompt-injected reviewer could edit files
+  through the edit tools. The reviewer's job is to judge work without changing it,
+  so it is now installed read-only on both harnesses, matching the explorer.
+  (Bash is intentionally not restricted by this posture on either read-only role,
+  unchanged from before.)
+
+## [0.7.0] - 2026-06-22
+
+### Added
+
+- Machine-readable solution-acceptance status markers in the run templates:
+  `06-handoff.md` carries a `<!-- solution-acceptance: final-status = TODO -->`
+  line and `05-review-findings.md` carries a
+  `<!-- solution-acceptance: acceptance-recommendation = TODO -->` line. The
+  orchestrator replaces the `TODO` sentinel with the chosen enum value when
+  finalizing the handoff/review. This is the run-gate contract the harness
+  solution-acceptance gate reads, so a freshly-copied run is non-accepting by
+  construction (fail-closed). SKILL.md documents the finalization step.
+
+## [0.6.0]
+
+### Changed
+
+- Portable opencode model resolution (#62).
+
+## [0.5.0]
+
+### Added
+
+- Instruction trust boundary for the workflow, policy, and agent prompts (#55).
+
+## [0.4.0]
+
+### Added
+
+- Read-only explorer/discovery role (#52).
+
+## [0.3.0]
+
+### Added
+
+- Proportionality rule for delegation (#51).
+
+## [0.2.0]
+
+### Added
+
+- Target-directory transparency and an `uninstall` command (#50).
+
+## [0.1.0]
+
+### Added
+
+- Initial `orchestrator-workflow` package: `.ai/` run state, an `AGENTS.md`
+  policy section, and per-harness subagent definitions (#47).

package/INSTALL-AGENT.md

@@ -107,8 +107,8 @@ steps in the repository you were asked to install into.
      `assets/skill/SKILL.md`. For each role, `.claude/agents/<role>.md` from
      `assets/agents/<role>.md` with `model: <operator's choice>` added as a
      new line directly after the `description:` line (that placement matches
-     the installer's output byte for byte). For the explorer role
-     additionally, `disallowedTools: Edit, Write, NotebookEdit` goes on a new
+     the installer's output byte for byte). For the explorer and reviewer
+     roles additionally, `disallowedTools: Edit, Write, NotebookEdit` goes on a new
      line directly after the `model:` line. Ensure `CLAUDE.md` exists and
      contains a line `@AGENTS.md`.
    - Codex: `.agents/skills/orchestrator-workflow/SKILL.md`, same skill file.
@@ -125,10 +125,11 @@ steps in the repository you were asked to install into.
      which is the safe portable fallback. The installed CLI resolves aliases
      to fully-qualified ids by running `opencode models` at install time; in a
      manual install you may not have a live catalog, so omitting `model:` is
-     correct. For the explorer role additionally, `permission:` goes on a new
+     correct. For the explorer and reviewer roles additionally, `permission:` goes on a new
      line directly after `mode: subagent` (or after `model:` when that line is
      present), followed by `  edit: deny` (two-space indent) on the next line.
-     Example explorer frontmatter when no model is resolved:
+     Example read-only role frontmatter (explorer or reviewer) when no model
+     is resolved:
      ```yaml
      ---
      description: "..."

package/README.md

@@ -97,9 +97,9 @@ Per selected harness:
 
 | Harness | Files | Notes |
 |---|---|---|
-| Claude Code | `.claude/skills/orchestrator-workflow/SKILL.md`, `.claude/agents/{explorer,task-slicer,implementer,reviewer}.md`, `CLAUDE.md` | Claude Code reads `CLAUDE.md`, not `AGENTS.md`; the installer adds an additive `@AGENTS.md` import. Subagent models go into the `model:` frontmatter; the read-only explorer also gets `disallowedTools: Edit, Write, NotebookEdit`. |
+| Claude Code | `.claude/skills/orchestrator-workflow/SKILL.md`, `.claude/agents/{explorer,task-slicer,implementer,reviewer}.md`, `CLAUDE.md` | Claude Code reads `CLAUDE.md`, not `AGENTS.md`; the installer adds an additive `@AGENTS.md` import. Subagent models go into the `model:` frontmatter; the read-only explorer and reviewer also get `disallowedTools: Edit, Write, NotebookEdit`. |
 | OpenAI Codex | `.agents/skills/orchestrator-workflow/SKILL.md` | Codex reads `AGENTS.md` natively. There is no standardized project-level subagent definition; the skill instructs running the roles inline with the same contracts. |
-| opencode | `.opencode/skills/orchestrator-workflow/SKILL.md`, `.opencode/agents/{explorer,task-slicer,implementer,reviewer}.md` | opencode reads `AGENTS.md` natively. Subagents get `mode: subagent`; the explorer also gets `permission: edit: deny`. Model resolution is described below. |
+| opencode | `.opencode/skills/orchestrator-workflow/SKILL.md`, `.opencode/agents/{explorer,task-slicer,implementer,reviewer}.md` | opencode reads `AGENTS.md` natively. Subagents get `mode: subagent`; the read-only explorer and reviewer also get `permission: edit: deny`. Model resolution is described below. |
 
 ## Model preselection
 

package/assets/skill/SKILL.md

@@ -106,6 +106,12 @@ directory and the subagents.
 9. **Hand off.** Fill `06-handoff.md` and report to the operator: what changed,
    why, how it was verified, known risks, accepted waivers, suggested next step.
 
+When finalizing `05-review-findings.md` and `06-handoff.md`, replace the `TODO`
+in each `<!-- solution-acceptance: ... = TODO -->` marker with the chosen enum
+value. That marker line is the machine-readable signal the harness
+solution-acceptance run-gate reads, so leaving it as `TODO` keeps the run
+non-accepting (fail-closed).
+
 ## Explorer output contract
 
 ```yaml

package/assets/templates/05-review-findings.md

@@ -21,3 +21,5 @@
 ## Acceptance Recommendation
 
 accept | accept_with_notes | fix_required | reject
+
+<!-- solution-acceptance: acceptance-recommendation = TODO -->

package/assets/templates/06-handoff.md

@@ -31,3 +31,5 @@
 ## Final Status
 
 accepted | accepted_with_notes | needs_followup | blocked
+
+<!-- solution-acceptance: final-status = TODO -->

package/dist/models.js

@@ -8,7 +8,10 @@ export const ROLES = [
  * Roles that map the terrain or judge work without changing it. They are
  * installed with a read-only posture (no file-mutation tools).
  */
-export const READ_ONLY_ROLES = new Set(["explorer"]);
+export const READ_ONLY_ROLES = new Set([
+    "explorer",
+    "reviewer",
+]);
 export const MODEL_ALIASES = ["sonnet", "opus", "haiku"];
 /**
  * Per-role defaults. The orchestrator itself runs on the session model and is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orchestrator-workflow",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Installer for an orchestrator-led agent workflow: .ai/ run state, an AGENTS.md policy section, and per-harness subagent definitions for Claude Code, OpenAI Codex, and opencode",
   "main": "dist/index.js",
   "type": "module",
@@ -11,7 +11,8 @@
     "dist",
     "assets",
     "README.md",
-    "INSTALL-AGENT.md"
+    "INSTALL-AGENT.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc",