pantheon-opencode 1.3.5-beta.52.c75b04d → 1.3.5-beta.57.2e03676

package/README.md

@@ -254,6 +254,25 @@ transition.
 **Timeout:** `background_delegation.timeout_ms` (default `900000` = 15 min). A job
 that has not reached a terminal state is finalized as `error`/`timedOut`.
 
+**Runtime delegation environment variables:**
+
+| Variable | Default | Scope and behavior |
+|---|---:|---|
+| `PANTHEON_ATHENA_APOLLO_BUDGET` | `5` dispatches | In-memory per `createDelegationTools()` factory/process instance and parent session, for the `athena → apollo` read-only exception. |
+| `PANTHEON_HERMES_APOLLO_BUDGET` | `5` dispatches | In-memory per `createDelegationTools()` factory/process instance and parent session, for the `hermes → apollo` read-only exception. |
+| `PANTHEON_DELEGATION_TIMEOUT_MS` | `900000` ms (15 min) | Per delegated child wall-clock timeout. The value is read when the plugin factory is created; unset or invalid values use the default. |
+
+Budgets are reserved before asynchronous child-session creation, so real
+concurrent calls cannot overshoot them. They reset when the factory/process
+restarts. If `ToolContext.agent` is missing, the default runtime matrix rejects
+the delegation (fail-closed); no caller identity or budget is inferred from the
+target, prompt, or session state. An explicitly legacy host using
+`enforceRuntimeMatrix: false` skips the budget because the caller cannot be
+identified and emits a warning. These budgets are separate from
+`background_delegation.max_concurrent_per_agent`: concurrency limits the number
+of currently running children, while an exception budget limits total dispatch
+reservations for that parent session during the factory lifetime.
+
 **Read-only enforcement:** delegating with `read_only: true`, or delegating to an
 agent in `background_delegation.read_only_agents` (`apollo`, `gaia`), registers
 the child session as read-only — the `tool.execute.before` guard denies
@@ -892,9 +911,12 @@ publishing. If they diverge, the release is blocked until they are reconciled.
 
 Beta releases are calculated from npm's published `latest` at workflow runtime:
 the default is the next patch, formatted as
-`<next-stable>-beta.<PR>.<short-sha>`. Labels `release:beta:minor` and
-`release:beta:major` request minor or major calculation. The workflow owns the
-manifest update, tag, and publish; it does not assume a fixed future version.
+`<next-stable>-beta.<PR>.<short-sha>`. Only the exact `release:beta` label
+triggers this path; alternate label variants do not trigger it. Beta recovery
+requires an explicit `workflow_dispatch` with its recovery inputs; a normal
+push does not republish beta. The workflow owns the manifest update, tag, and
+publish, creates the GitHub Release as `Pantheon <version>`, and does not create
+PR comments.
 
 ### Anti-patterns
 

package/opencode.json

@@ -38,15 +38,6 @@
     }
   },
   "agent": {
-    "athena": {
-      "model": "opencode-go/kimi-k3"
-    },
-    "themis": {
-      "model": "opencode-go/deepseek-v4-pro"
-    },
-    "hephaestus": {
-      "model": "opencode-go/deepseek-v4-pro"
-    },
     "talos": {
       "permission": {
         "edit": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pantheon-opencode",
-  "version": "1.3.5-beta.52.c75b04d",
+  "version": "1.3.5-beta.57.2e03676",
   "description": "Multi-agent orchestration for OpenCode — 14 specialized agents, TDD, Themis review gates.",
   "publishConfig": {
     "access": "public",

package/scripts/doctor.mjs

@@ -757,7 +757,7 @@ function checkPermissionMismatches(args) {
 // Check D: Sync Status
 // ---------------------------------------------------------------------------
 
-function checkSyncStatus(args) {
+function checkSyncStatus(_args) {
   section('D. Sync Status')
 
   // Platform sync removed in v1.0 (OpenCode-only)
@@ -979,9 +979,207 @@ function checkVenvLayer(args) {
 }
 
 // ---------------------------------------------------------------------------
-// Summary
+// Check G: AGENTS.md freshness
 // ---------------------------------------------------------------------------
 
+/**
+ * Check AGENTS.md only where the repository's generator can provide a real
+ * source-of-truth comparison. Installed targets have no canonical instruction
+ * sources available to this process, so their freshness is deliberately not
+ * guessed from file age.
+ */
+function checkAgentsMdFreshness(args) {
+  section('G. AGENTS.md Freshness')
+
+  const agentsMdPath = join(args.target, 'AGENTS.md')
+  if (args.target !== ROOT) {
+    const outcome = classifyAgentsMdFreshness({
+      targetIsRoot: false,
+      agentsMdExists: existsSync(agentsMdPath),
+      generatorExists: false,
+    })
+    if (outcome === 'unverified') {
+      info(
+        'AGENTS.md is present; freshness was not checked because the canonical generator sources are not available in an installed target',
+      )
+    } else {
+      warn(
+        'AGENTS.md is not present; freshness cannot be verified for this installed target — run `pantheon-opencode init --components instructions`',
+      )
+    }
+    return
+  }
+
+  const generator = join(ROOT, 'scripts', 'build-agents-md.mjs')
+  if (!existsSync(generator)) {
+    info('AGENTS.md freshness skipped — canonical generator is not available')
+    return
+  }
+
+  const result = spawn(process.execPath, [generator, '--check'], ROOT)
+  const outcome = classifyAgentsMdFreshness({
+    targetIsRoot: true,
+    agentsMdExists: existsSync(agentsMdPath),
+    generatorExists: true,
+    generatorStatus: result.status,
+  })
+  if (outcome === 'pass') {
+    pass('AGENTS.md matches the canonical generated instructions')
+  } else if (outcome === 'unverified' && !existsSync(agentsMdPath)) {
+    warn(
+      'AGENTS.md is missing — run `node scripts/build-agents-md.mjs` or `pantheon-opencode init`',
+    )
+  } else if (outcome === 'stale') {
+    warn('AGENTS.md is stale — run `node scripts/build-agents-md.mjs` to refresh it')
+  } else {
+    warn(
+      `AGENTS.md freshness could not be verified (generator exited ${result.status ?? 'unknown'})`,
+    )
+  }
+}
+
+/**
+ * Classify the generator result without relying on timestamps or fragile
+ * process mocks. The doctor CLI uses the same result contract internally.
+ *
+ * @param {{ targetIsRoot: boolean; agentsMdExists: boolean; generatorExists: boolean; generatorStatus?: number | null }} input
+ * @returns {'pass' | 'missing' | 'stale' | 'skipped' | 'unverified'}
+ */
+export function classifyAgentsMdFreshness(input) {
+  if (!input.targetIsRoot) return input.agentsMdExists ? 'unverified' : 'missing'
+  if (!input.generatorExists) return 'skipped'
+  if (input.generatorStatus === 0) return 'pass'
+  if (input.generatorStatus === 1 && input.agentsMdExists) return 'stale'
+  return 'unverified'
+}
+
+// ---------------------------------------------------------------------------
+// Check H: Config migration — no top-level subagent_depth
+// ---------------------------------------------------------------------------
+
+function checkSubagentDepthPlacement(args) {
+  section('H. Config Migration')
+
+  const configs = collectMcpConfigs(args)
+  if (configs.length === 0) {
+    info('subagent_depth placement check skipped — no opencode.json was found')
+    return
+  }
+  for (const cfg of configs) {
+    if (cfg.data.subagent_depth !== undefined) {
+      error(
+        `${cfg.label}: top-level "subagent_depth" is unsupported — run \`pantheon-opencode init\` to migrate it to "experimental.subagent_depth"`,
+      )
+    } else if (
+      cfg.data.experimental &&
+      typeof cfg.data.experimental === 'object' &&
+      cfg.data.experimental.subagent_depth !== undefined
+    ) {
+      pass(`${cfg.label}: experimental.subagent_depth = ${cfg.data.experimental.subagent_depth}`)
+    } else {
+      info(
+        `${cfg.label}: experimental.subagent_depth is not configured (older/custom config may omit it)`,
+      )
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Check J: Agent permission.task presence
+// ---------------------------------------------------------------------------
+
+/** @param {string} content @returns {boolean} */
+export function hasPermissionTask(content) {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/)
+  if (!match) return false
+  const permission = match[1].match(/(?:^|\r?\n)permission:\s*\r?\n([\s\S]*?)(?=\r?\n\S|$)/)
+  return Boolean(permission && /^\s+task:\s*/m.test(permission[1]))
+}
+
+/**
+ * Derive installed agent files from the paths already declared by configs.
+ * This supports both global flat and project .opencode layouts without
+ * assuming a user home directory.
+ *
+ * @param {{path: string, data: object}[]} configs
+ * @returns {string[]}
+ */
+export function deriveInstalledAgentFiles(configs) {
+  const directories = new Set()
+  for (const cfg of configs) {
+    for (const agent of Object.values(cfg.data.agent ?? {})) {
+      const source = agent && typeof agent === 'object' ? agent.source : undefined
+      if (typeof source !== 'string' || !source.includes('/')) continue
+      const filePath = resolve(dirname(cfg.path), source)
+      if (filePath.startsWith(`${AGENTS_DIR}/`)) continue
+      if (existsSync(filePath)) directories.add(dirname(filePath))
+    }
+  }
+
+  const files = []
+  for (const directory of directories) {
+    let entries
+    try {
+      entries = readdirSync(directory, { withFileTypes: true })
+    } catch {
+      continue
+    }
+    for (const entry of entries) {
+      if (entry.isFile() && entry.name.endsWith('.md')) files.push(join(directory, entry.name))
+    }
+  }
+  return [...new Set(files)].sort()
+}
+
+function checkPermissionTaskPresence(args) {
+  section('J. Installed Agent permission.task')
+
+  if (args.profile === 'lite') {
+    info(
+      'Installed agent permission.task check skipped (lite profile does not require managed agents)',
+    )
+    return
+  }
+
+  const installedFiles = deriveInstalledAgentFiles(collectMcpConfigs(args))
+  if (installedFiles.length === 0) {
+    info(
+      'Installed agent permission.task check skipped — no agent source directory could be derived from available config',
+    )
+    return
+  }
+
+  const missing = findMissingPermissionTask(installedFiles)
+  if (classifyPermissionTaskCheck(args.profile, installedFiles.length, missing.length) === 'pass') {
+    pass(`All ${installedFiles.length} installed agents have permission.task`)
+    return
+  }
+
+  for (const filePath of missing) {
+    error(
+      `${basename(filePath)}: missing permission.task in managed agent — run \`pantheon-opencode init\` to update installed agents`,
+    )
+  }
+}
+
+/** @param {string[]} filePaths @returns {string[]} */
+export function findMissingPermissionTask(filePaths) {
+  return filePaths.filter((filePath) => !hasPermissionTask(readFileSync(filePath, 'utf8')))
+}
+
+/**
+ * Classify the installed-agent permission.task layer for a doctor profile.
+ *
+ * @param {string} profile
+ * @param {number} installedCount
+ * @param {number} missingCount
+ * @returns {'skip' | 'pass' | 'error'}
+ */
+export function classifyPermissionTaskCheck(profile, installedCount, missingCount) {
+  if (profile === 'lite' || installedCount === 0) return 'skip'
+  return missingCount === 0 ? 'pass' : 'error'
+}
+
 /**
  * Return the final doctor status message without masking blocking errors.
  * @param {{ error: number; warn: number }} summaryCounts
@@ -1069,6 +1267,9 @@ async function main() {
   checkPermissionMismatches(args)
   checkSyncStatus(args)
   checkGitStatus(args)
+  checkAgentsMdFreshness(args)
+  checkSubagentDepthPlacement(args)
+  checkPermissionTaskPresence(args)
 
   printSummary(args.target)
 

package/scripts/validate-routing.mjs

@@ -89,7 +89,9 @@ for (const dir of [srcSkillsDir, dotSkillsDir]) {
         if (existsSync(join(skillDir, 'SKILL.md')) && !existingSkills.includes(d)) {
           existingSkills.push(d)
         }
-      } catch { /* skip */ }
+      } catch {
+        /* skip */
+      }
     }
   }
 }
@@ -165,6 +167,168 @@ for (const w of presetValidation.warnings) {
 }
 console.log(`  Presets defined: ${Object.keys(presetDefs).length}`)
 
+// G. Delegation Matrix Invariants (B1 — Zeus strict + read-only exceptions)
+console.log(`\n  Delegation matrix invariants:`)
+
+// G1. can_delegate: true only for zeus, athena (→apollo), hermes (→apollo)
+const CAN_DELEGATE_AGENTS = ['zeus', 'athena', 'hermes']
+for (const [name, agentInfo] of Object.entries(routing.agents || {})) {
+  if (agentInfo.can_delegate === true) {
+    check(
+      CAN_DELEGATE_AGENTS.includes(name),
+      `Agent "${name}" has can_delegate: true but is not in allowed list [${CAN_DELEGATE_AGENTS}]`,
+    )
+  }
+}
+
+// G3. subagent_can_delegate_to only references existing agents
+for (const [name, agentInfo] of Object.entries(routing.agents || {})) {
+  const delegates = agentInfo.subagent_can_delegate_to || []
+  for (const target of delegates) {
+    check(
+      routingAgents.includes(target),
+      `Agent "${name}" can_delegate_to unknown agent "${target}"`,
+    )
+  }
+}
+
+// G4. athena and hermes can only delegate to apollo (read-only exception)
+for (const agentName of ['athena', 'hermes']) {
+  const agentInfo = routing.agents[agentName]
+  if (agentInfo) {
+    const delegates = agentInfo.subagent_can_delegate_to || []
+    check(
+      delegates.length <= 1 && delegates[0] === 'apollo',
+      `Agent "${agentName}" subagent_can_delegate_to must be [apollo] only, got [${delegates}]`,
+    )
+  }
+}
+
+// G5. Frontmatter permission.task invariants
+const AGENT_FILES_DIR = join(ROOT, 'src', 'agents')
+const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---/
+
+function parseFrontmatter(filePath) {
+  const content = readFileSync(filePath, 'utf8')
+  const match = content.match(FRONTMATTER_RE)
+  if (!match) return null
+  try {
+    return yaml.load(match[1])
+  } catch {
+    return null
+  }
+}
+
+// G5a. Frontmatter mode must match routing.yml task eligibility.
+const frontmatterByAgent = new Map()
+for (const agentName of canonicalFiles) {
+  frontmatterByAgent.set(agentName, parseFrontmatter(join(AGENT_FILES_DIR, `${agentName}.md`)))
+}
+
+for (const [name, agentInfo] of Object.entries(routing.agents || {})) {
+  const fm = frontmatterByAgent.get(name)
+  if (!fm) continue
+
+  if (name === 'zeus') {
+    check(fm.mode === 'primary', 'Agent "zeus" must use mode primary')
+  } else if (agentInfo.can_receive_delegation === true) {
+    const expectedMode = agentInfo.user_invocable === true ? 'all' : 'subagent'
+    check(
+      fm.mode === expectedMode,
+      `Agent "${name}" mode must be "${expectedMode}" for routing.yml eligibility, got "${fm.mode}"`,
+    )
+  }
+}
+
+// G5b. Zeus targets must exist, receive delegation, and never be primary.
+for (const targetEntry of routing.delegation?.zeus || []) {
+  const target = typeof targetEntry === 'string' ? targetEntry : targetEntry.target
+  const targetInfo = routing.agents[target]
+  const targetFm = frontmatterByAgent.get(target)
+  check(targetInfo !== undefined, `Zeus delegation target "${target}" must exist`)
+  if (targetInfo && targetFm) {
+    check(
+      targetInfo.can_receive_delegation === true && targetFm.mode !== 'primary',
+      `Zeus delegation target "${target}" must not be mode primary and must receive delegation`,
+    )
+  }
+}
+
+// G5c. Every subagent delegation target must exist and be eligible.
+for (const [name, agentInfo] of Object.entries(routing.agents || {})) {
+  for (const target of agentInfo.subagent_can_delegate_to || []) {
+    const targetInfo = routing.agents[target]
+    const targetFm = frontmatterByAgent.get(target)
+    check(targetInfo !== undefined, `Agent "${name}" can_delegate_to unknown agent "${target}"`)
+    if (targetInfo && targetFm) {
+      check(
+        targetInfo.can_receive_delegation === true && targetFm.mode !== 'primary',
+        `Agent "${name}" can_delegate_to target "${target}" is not eligible`,
+      )
+    }
+  }
+}
+
+// Expected permission.task matrix
+const EXPECTED_TASK_PERMISSIONS = {
+  zeus: { '*': 'allow' },
+  athena: { '*': 'deny', apollo: 'allow' },
+  hermes: { '*': 'deny', apollo: 'allow' },
+  themis: { '*': 'deny' },
+  aphrodite: { '*': 'deny' },
+  demeter: { '*': 'deny' },
+  apollo: { '*': 'deny' },
+  gaia: { '*': 'deny' },
+  prometheus: { '*': 'deny' },
+  hephaestus: { '*': 'deny' },
+  nyx: { '*': 'deny' },
+  iris: { '*': 'deny' },
+  talos: { '*': 'deny' },
+  mnemosyne: { '*': 'deny' },
+}
+
+for (const agentName of canonicalFiles) {
+  const fmPath = join(AGENT_FILES_DIR, `${agentName}.md`)
+  const fm = parseFrontmatter(fmPath)
+  if (!fm) {
+    check(false, `Agent "${agentName}" has no valid frontmatter`)
+    continue
+  }
+
+  // G5a. permission.task must exist
+  const hasTask = fm.permission?.task
+  check(hasTask, `Agent "${agentName}" missing permission.task in frontmatter`)
+
+  if (!hasTask) continue
+
+  // G5b. Only zeus may have "*": allow
+  const starRule = fm.permission.task['*']
+  if (starRule === 'allow') {
+    check(
+      agentName === 'zeus',
+      `Agent "${agentName}" has permission.task "*": allow — only zeus is allowed`,
+    )
+  }
+
+  // G5c. Verify exact expected permissions
+  const expected = EXPECTED_TASK_PERMISSIONS[agentName]
+  if (expected) {
+    const actual = fm.permission.task
+    const actualKeys = Object.keys(actual).sort()
+    const expectedKeys = Object.keys(expected).sort()
+    check(
+      JSON.stringify(actualKeys) === JSON.stringify(expectedKeys),
+      `Agent "${agentName}" permission.task keys mismatch: expected [${expectedKeys}], got [${actualKeys}]`,
+    )
+    for (const [key, val] of Object.entries(expected)) {
+      check(
+        actual[key] === val,
+        `Agent "${agentName}" permission.task.${key}: expected "${val}", got "${actual[key]}"`,
+      )
+    }
+  }
+}
+
 // Summary
 console.log(`\n${'='.repeat(50)}`)
 const status = failures === 0 ? '✅ PASSED' : `❌ FAILED (${failures}/${checks} checks failed)`

package/src/agents/aphrodite.md

@@ -1,7 +1,7 @@
 ---
 name: aphrodite
 description: "Frontend specialist — React 19, TypeScript strict, WCAG accessibility, responsive design, TDD, modern API patterns, deprecated npm detection. Calls apollo for discovery, sends to themis for review."
-mode: primary
+mode: all
 reasoning_effort: medium
 permission:
   read: allow
@@ -11,6 +11,8 @@ permission:
   webfetch: allow
   glob: allow
   question: allow
+  task:
+    "*": deny
 temperature: 0.3
 steps: 50
 skills:

package/src/agents/apollo.md

@@ -10,6 +10,8 @@ permission:
   webfetch: allow
   edit: deny
   bash: deny
+  task:
+    "*": deny
 temperature: 0.1
 steps: 30
 skills:

package/src/agents/athena.md

@@ -3,7 +3,7 @@ name: athena
 description: Strategic planner & architect — research-first, plan-only, never implements.
   Plans include quality gates (ruff/Biome, dep detection, LTS policy). Calls apollo
   for discovery.
-mode: primary
+mode: all
 reasoning_effort: high
 
 steps: 30
@@ -21,6 +21,9 @@ permission:
   grep: allow
   glob: allow
   webfetch: allow
+  task:
+    "*": deny
+    apollo: allow
 ---
 
 ##  When NOT to Use Athena

package/src/agents/demeter.md

@@ -1,7 +1,7 @@
 ---
 name: demeter
 description: "Database specialist — SQLAlchemy 2.0, Alembic, query optimization, N+1 prevention, TDD migrations, modern DB libs. Calls apollo for discovery, sends to themis."
-mode: primary
+mode: all
 reasoning_effort: medium
 permission:
   read: allow
@@ -9,6 +9,8 @@ permission:
   edit: allow
   bash: allow
   webfetch: allow
+  task:
+    "*": deny
 temperature: 0.2
 steps: 40
 skills:

package/src/agents/gaia.md

@@ -9,6 +9,8 @@ permission:
   webfetch: allow
   edit: deny
   bash: deny
+  task:
+    "*": deny
 temperature: 0.2
 steps: 30
 skills:

package/src/agents/hephaestus.md

@@ -1,7 +1,7 @@
 ---
 name: hephaestus
 description: "AI tooling & pipelines specialist — LangChain/LangGraph chains, RAG architecture, vector stores, embedding strategies. Forges AI infrastructure. Calls apollo, sends to themis."
-mode: subagent
+mode: all
 reasoning_effort: medium
 permission:
   read: allow
@@ -9,6 +9,8 @@ permission:
   edit: allow
   bash: allow
   webfetch: allow
+  task:
+    "*": deny
 temperature: 0.3
 steps: 40
 skills:

package/src/agents/hermes.md

@@ -3,7 +3,7 @@ name: hermes
 description: Backend specialist — FastAPI, Python, async, TDD (RED→GREEN→REFACTOR),
   modern Python stdlib, obsolete lib detection. Calls apollo for discovery, sends
   to themis.
-mode: primary
+mode: all
 reasoning_effort: medium
 
 mcp_tools:
@@ -25,6 +25,9 @@ permission:
   edit: allow
   webfetch: allow
   glob: allow
+  task:
+    "*": deny
+    apollo: allow
 ---
 
 ## Table of Contents

package/src/agents/iris.md

@@ -1,7 +1,7 @@
 ---
 name: iris
 description: "GitHub operations specialist — branches, pull requests, issues, releases, tags. Called by zeus after review. Never pushes or merges without explicit human approval. Integrates with GitHub CLI (gh) for operations."
-mode: subagent
+mode: all
 reasoning_effort: low
 permission:
   read: allow
@@ -11,6 +11,8 @@ permission:
     gh *: allow
   webfetch: allow
   edit: deny
+  task:
+    "*": deny
 temperature: 0.2
 steps: 25
 skills:

package/src/agents/mnemosyne.md

@@ -3,7 +3,7 @@ name: mnemosyne
 description: Memory bank quality owner — initializes .pantheon/memory-bank/, writes ADRs
   and task records on explicit request. Called by zeus. Never invoked automatically
   after phases.
-mode: primary
+mode: all
 reasoning_effort: low
 
 steps: 25
@@ -35,6 +35,8 @@ permission:
   read: allow
   grep: allow
   edit: deny
+  task:
+    "*": deny
 ---
 
 ## ⚠️ SCOPE BOUNDARY

package/src/agents/nyx.md

@@ -1,7 +1,7 @@
 ---
 name: nyx
 description: "Observability & monitoring specialist — OpenTelemetry tracing, token/cost tracking, agent performance analytics, LangSmith integration. Calls apollo for discovery, sends to themis."
-mode: subagent
+mode: all
 reasoning_effort: low
 permission:
   read: allow
@@ -9,6 +9,8 @@ permission:
   bash: allow
   webfetch: allow
   edit: deny
+  task:
+    "*": deny
 temperature: 0.1
 steps: 25
 skills:

package/src/agents/prometheus.md

@@ -1,7 +1,7 @@
 ---
 name: prometheus
 description: "Infrastructure + model provider specialist — Docker, CI/CD, multi-model routing, cost optimization, provider abstraction"
-mode: subagent
+mode: all
 reasoning_effort: medium
 permission:
   read: allow
@@ -9,6 +9,8 @@ permission:
   edit: allow
   bash: allow
   webfetch: allow
+  task:
+    "*": deny
 temperature: 0.2
 steps: 30
 skills:

package/src/agents/talos.md

@@ -1,12 +1,14 @@
 ---
 name: talos
 description: "Hotfix express lane — direct fixes for small bugs, CSS, typos, minor logic. No TDD ceremony, no orchestration overhead. Standalone, no subagents. Escalates complex issues to zeus."
-mode: subagent
+mode: all
 reasoning_effort: low
 permission:
   read: allow
   edit: allow
   bash: allow
+  task:
+    "*": deny
 temperature: 0.3
 steps: 35
 skills: