pantheon-opencode 1.6.0-beta.6 → 1.6.0-beta.8

package/scripts/sync-artifacts.mjs

@@ -19,10 +19,10 @@
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs'
 import { join } from 'node:path'
+import { copyAgentPrompts } from './build-agents-md.mjs'
 
 import {
   collectSkillNames,
-  copyFiles,
   installSkills,
   ROOT,
   syncDir,
@@ -59,7 +59,7 @@ export function syncCopyArtifacts(configDir) {
     const dstAgents = join(configDir, 'agents')
     if (existsSync(join(ROOT, 'src', 'agents'))) {
       mkdirSync(dstAgents, { recursive: true })
-      bump(copyFiles(join(ROOT, 'src', 'agents'), dstAgents, false))
+      bump(copyAgentPrompts(join(ROOT, 'src', 'agents'), dstAgents, false))
       const routing = join(ROOT, 'src', 'routing.yml')
       if (existsSync(routing)) {
         if (

package/scripts/test-opencode-v2-sandbox.sh

@@ -34,7 +34,7 @@
 # Env overrides:
 #   PANTHEON_SANDBOX_ROOT    Sandbox root (default: ~/pantheon-sandbox)
 #   OPENCODE_V2_SPEC         npm spec providing the V2 binary
-#                            (default: @opencode-ai/cli@beta). NOTE: this is an
+#                            (default: @opencode/cli@latest). NOTE: this is an
 #                            install spec only — it is not a dependency of this
 #                            package, and no code imports it.
 #   PANTHEON_REPO            Repository the sandbox is built from (default: the
@@ -63,7 +63,7 @@ SANDBOX_ROOT="${PANTHEON_SANDBOX_ROOT:-$HOME/pantheon-sandbox}"
 SANDBOX_HOME="$SANDBOX_ROOT/home"
 NPM_PREFIX="$SANDBOX_HOME/.npm-global"
 
-OPENCODE_V2_SPEC="${OPENCODE_V2_SPEC:-@opencode-ai/cli@beta}"
+OPENCODE_V2_SPEC="${OPENCODE_V2_SPEC:-@opencode/cli@latest}"
 PANTHEON_SANDBOX_MODEL="${PANTHEON_SANDBOX_MODEL:-opencode-go/mimo-v2.5}"
 PANTHEON_PROMPT_TIMEOUT="${PANTHEON_PROMPT_TIMEOUT:-300}"
 
@@ -418,6 +418,7 @@ V2_DB="${PANTHEON_V2_DB:-$SANDBOX_DIR/opencode-v2.db}"
 V2_PORT="${PANTHEON_V2_PORT:-49376}"
 V2_LOOPBACK_HOST="${PANTHEON_V2_HOST:-127.0.0.1}"
 V2_HANDSHAKE_TIMEOUT="${PANTHEON_V2_HANDSHAKE_TIMEOUT:-60}"
+V2_MCP_LIST_TIMEOUT="${PANTHEON_V2_MCP_LIST_TIMEOUT:-15}"
 V2_SERVER_LOG="$SANDBOX_DIR/v2-server.log"
 V2_SERVICE_STATE="$SANDBOX_HOME/.local/state/opencode/service.json"
 V2_SERVER_PID=""
@@ -735,7 +736,8 @@ check_mcp() { # label binary project
   if ! wait_for_v2_mcp_registrations "$project/.opencode" "$project/.venv/bin/python3"; then
     kill "$list_pid" 2>/dev/null || true
     wait "$list_pid" 2>/dev/null || true
-    rm -f "$list_file"
+    echo "--- mcp list output (preserved at $list_file) ---" >&2
+    cat "$list_file" >&2 || true
     record_status "$label MCP" "FAIL" "MCP registrations did not match the active sandbox"
     return 0
   fi
@@ -744,7 +746,8 @@ check_mcp() { # label binary project
   else
     kill "$list_pid" 2>/dev/null || true
     wait "$list_pid" 2>/dev/null || true
-    rm -f "$list_file"
+    echo "--- mcp list output (preserved at $list_file) ---" >&2
+    cat "$list_file" >&2 || true
     record_status "$label MCP" "FAIL" "MCP handshakes did not become ready after mcp list started"
     return 0
   fi
@@ -809,6 +812,11 @@ if ! git -C "$REPO_DIR" ls-files --error-unmatch -- "$TGZ" >/dev/null 2>&1; then
 echo "--- Init (headless) ---"
 pantheon-opencode init --headless -y
 rewrite_v2_mcp_config
+node "$REPO_DIR/scripts/validate-sandbox-install.mjs" \
+  --repo "$REPO_DIR" \
+  --install "$NPM_PREFIX/lib/node_modules/pantheon-opencode" \
+  --project-config "$V2_CONFIG" \
+  --config "$PANTHEON_GLOBAL/opencode.json"
 
 echo "--- MCP Validation ---"
 check_mcp "V2" opencode2 "$SANDBOX_DIR/project-v2"
@@ -871,6 +879,139 @@ fi
 echo "Next: open the isolated TUI with: $SANDBOX_DIR/start-pantheon.sh"
 RUNTEST
   chmod +x "$SANDBOX_ROOT/run-test.sh"
+
+  cat > "$SANDBOX_ROOT/start-pantheon.sh" <<'STARTPANTHEON'
+#!/usr/bin/env bash
+# Generated by pantheon-opencode scripts/test-opencode-v2-sandbox.sh --prepare
+# Launches the installed OpenCode beta with only this sandbox's HOME/config/db.
+set -euo pipefail
+
+SANDBOX_DIR="$(cd "$(dirname "$0")" && pwd)"
+SANDBOX_HOME="$SANDBOX_DIR/home"
+NPM_PREFIX="$SANDBOX_HOME/.npm-global"
+SANDBOX_VENV="$SANDBOX_HOME/.config/opencode/.venv"
+V2_PORT="${PANTHEON_V2_PORT:-49376}"
+if [[ ! "$V2_PORT" =~ ^[0-9]{1,5}$ ]]; then
+  echo "ERROR: PANTHEON_V2_PORT must be an integer from 1 through 65535 (got '$V2_PORT')" >&2
+  exit 1
+fi
+V2_PORT=$((10#$V2_PORT))
+if [ "$V2_PORT" -lt 1 ] || [ "$V2_PORT" -gt 65535 ]; then
+  echo "ERROR: PANTHEON_V2_PORT must be an integer from 1 through 65535 (got '$V2_PORT')" >&2
+  exit 1
+fi
+if ! python3 - "$V2_PORT" "$NPM_PREFIX" <<'CHECKPORT'
+import errno
+import os
+import socket
+import sys
+from urllib.request import urlopen
+
+port = int(sys.argv[1])
+cli_prefix = os.path.realpath(
+    os.path.join(sys.argv[2], "lib", "node_modules", "@opencode", "cli")
+)
+try:
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as probe:
+        # A just-stopped service can leave a harmless TIME_WAIT socket behind.
+        # SO_REUSEADDR permits the new service to bind that port without
+        # masking a live listener or an unrelated server.
+        probe.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        probe.bind(("127.0.0.1", port))
+except OSError as exc:
+    if exc.errno != errno.EADDRINUSE:
+        print(f"ERROR: cannot reserve dedicated V2 port 127.0.0.1:{port}: {exc}", file=sys.stderr)
+        raise SystemExit(1)
+
+    # OpenCode intentionally keeps its managed service alive after the TUI exits.
+    # Reuse it only when /proc proves the listener is this sandbox's CLI binary.
+    inodes = set()
+    for table in ("/proc/net/tcp", "/proc/net/tcp6"):
+        try:
+            with open(table, encoding="ascii") as entries:
+                next(entries, None)
+                for line in entries:
+                    fields = line.split()
+                    if len(fields) >= 10 and int(fields[1].rsplit(":", 1)[1], 16) == port and fields[3] == "0A":
+                        inodes.add(fields[9])
+        except OSError:
+            pass
+
+    listener_pids = set()
+    for pid in (entry for entry in os.listdir("/proc") if entry.isdigit()):
+        fd_dir = f"/proc/{pid}/fd"
+        try:
+            for fd in os.listdir(fd_dir):
+                try:
+                    target = os.readlink(os.path.join(fd_dir, fd))
+                except OSError:
+                    continue
+                if target.startswith("socket:[") and target[8:-1] in inodes:
+                    listener_pids.add(pid)
+                    break
+        except OSError:
+            continue
+
+    owns_listener = False
+    for pid in listener_pids:
+        try:
+            with open(f"/proc/{pid}/cmdline", "rb") as command_line:
+                args = [arg.decode(errors="replace") for arg in command_line.read().split(b"\0") if arg]
+        except OSError:
+            continue
+        executable = os.path.realpath(args[0]) if args else ""
+        if (
+            executable.startswith(cli_prefix + os.sep)
+            and "serve" in args
+            and "--service" in args
+            and len(listener_pids) == 1
+        ):
+            owns_listener = True
+            break
+
+    healthy = False
+    if owns_listener:
+        try:
+            scheme = "http"
+            loopback = ".".join(("127", "0", "0", "1"))
+            with urlopen(f"{scheme}://{loopback}:{port}/global/health", timeout=2) as response:
+                healthy = response.status == 200
+        except Exception:
+            pass
+
+    if not healthy:
+        print(
+            f"ERROR: dedicated V2 port 127.0.0.1:{port} is occupied by a different or unverifiable service; no service was stopped",
+            file=sys.stderr,
+        )
+        raise SystemExit(1)
+    print(f"Reusing the existing beta sandbox OpenCode service on 127.0.0.1:{port} (PID {next(iter(listener_pids))}).")
+CHECKPORT
+then
+  exit 1
+fi
+
+export HOME="$SANDBOX_HOME"
+export PATH="$NPM_PREFIX/bin:$SANDBOX_VENV/bin:$PATH"
+export npm_config_prefix="$NPM_PREFIX"
+export XDG_CONFIG_HOME="$SANDBOX_HOME/.config"
+export XDG_CONFIG_DIRS="$SANDBOX_HOME/.config/xdg"
+export XDG_DATA_HOME="$SANDBOX_HOME/.local/share"
+export XDG_DATA_DIRS="$SANDBOX_HOME/.local/share/xdg"
+export XDG_STATE_HOME="$SANDBOX_HOME/.local/state"
+export XDG_CACHE_HOME="$SANDBOX_HOME/.cache"
+export OPENCODE_CONFIG_DIR="$SANDBOX_DIR/project-v2"
+export OPENCODE_DB="${PANTHEON_V2_DB:-$SANDBOX_DIR/opencode-v2.db}"
+export PANTHEON_V2_PORT="$V2_PORT"
+export PORT="$PANTHEON_V2_PORT"
+unset OPENCODE_CONFIG OPENCODE_CONFIG_CONTENT OPENCODE_CONFIG_PROJECT_DISABLE \
+  OPENCODE_DATA_DIR OPENCODE_STATE_DIR OPENCODE_CACHE_DIR OPENCODE_STORAGE_PATH
+
+"$NPM_PREFIX/bin/opencode2" service set port "$V2_PORT"
+cd "$SANDBOX_DIR/project-v2"
+exec "$NPM_PREFIX/bin/opencode2" "$@"
+STARTPANTHEON
+  chmod +x "$SANDBOX_ROOT/start-pantheon.sh"
 }
 
 # ── Reset / Prepare ───────────────────────────────────────────────────────────
@@ -990,6 +1131,7 @@ prepare_project() {
   (cd "$dir" && "$pan" init --project --version "$TARGET_VERSION" --model "$PANTHEON_SANDBOX_MODEL" -y) \
     || die "init --project --version $TARGET_VERSION failed in $dir"
   rewrite_v2_mcp_config
+  validate_sandbox_install
 }
 
 # The installer merges an existing project config. A reused sandbox can
@@ -1077,6 +1219,15 @@ for name, script in managed.items():
 PY
 }
 
+validate_sandbox_install() {
+  node "$REPO_DIR/scripts/validate-sandbox-install.mjs" \
+    --repo "$REPO_DIR" \
+    --install "$NPM_PREFIX/lib/node_modules/pantheon-opencode" \
+    --project-config "$V2_CONFIG" \
+    --config "$SANDBOX_HOME/.config/opencode/opencode.json" \
+    || die "sandbox package/config validation failed"
+}
+
 cmd_prepare() {
   mkdir -p "$SANDBOX_HOME" "$NPM_PREFIX"
   write_run_test_sh

package/scripts/validate-sandbox-install.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const PACKAGE_REF = /^(?:npm:)?pantheon-opencode(?:@[^/]+)?(?:\/(?:plugin|plugin-v2))?$/
+export const SANDBOX_SOURCE_FILES = [
+  'bin/pantheon-init.mjs',
+  'scripts/install/config-migration.mjs',
+  'scripts/install/opencode.mjs',
+  'scripts/validate-sandbox-install.mjs',
+  'src/plugin-v2.ts',
+]
+
+function readJson(path, label) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error(`cannot read ${label} at ${path}: ${error.message}`)
+  }
+}
+
+function pluginReferences(config) {
+  const refs = []
+  for (const key of ['plugin', 'plugins']) {
+    const value = config?.[key]
+    const entries = Array.isArray(value) ? value : value === undefined ? [] : [value]
+    for (const entry of entries) {
+      if (typeof entry === 'string') refs.push(entry)
+      else if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+        for (const field of ['package', 'id', 'name', 'path', 'source']) {
+          if (typeof entry[field] === 'string') refs.push(entry[field])
+        }
+      }
+    }
+  }
+  return refs
+}
+
+/**
+ * Prove that the sandbox is executing the package built from this checkout and
+ * that the project config cannot silently load an older npm-cached Pantheon.
+ */
+export function validateSandboxInstall({ repoDir, installDir, projectConfig, configPaths = [] }) {
+  const sourcePackagePath = join(resolve(repoDir), 'package.json')
+  const installedPackagePath = join(resolve(installDir), 'package.json')
+  const sourcePackage = readJson(sourcePackagePath, 'checkout package manifest')
+  const installedPackage = readJson(installedPackagePath, 'sandbox package manifest')
+  if (sourcePackage.version !== installedPackage.version) {
+    throw new Error(
+      `sandbox package version ${installedPackage.version} does not match checkout ${sourcePackage.version}`,
+    )
+  }
+
+  const sourceHash = createHash('sha256')
+  for (const relativePath of SANDBOX_SOURCE_FILES) {
+    let source
+    let installed
+    try {
+      source = readFileSync(join(resolve(repoDir), relativePath))
+      installed = readFileSync(join(resolve(installDir), relativePath))
+    } catch (error) {
+      throw new Error(`cannot compare package source ${relativePath}: ${error.message}`)
+    }
+    if (!source.equals(installed)) {
+      throw new Error(`installed package source differs from checkout: ${relativePath}`)
+    }
+    sourceHash.update(relativePath).update('\0').update(installed).update('\0')
+  }
+
+  const expectedPluginPath = resolve(installDir, 'src', 'plugin-v2')
+  const allConfigPaths = [...new Set([projectConfig, ...configPaths].map((path) => resolve(path)))]
+  let activeProjectPluginCount = 0
+  for (const configPath of allConfigPaths) {
+    const config = readJson(configPath, 'active OpenCode config')
+    if (!config || typeof config !== 'object' || Array.isArray(config)) {
+      throw new Error(`active OpenCode config must be an object: ${configPath}`)
+    }
+    for (const ref of pluginReferences(config)) {
+      const normalized = ref.replaceAll('\\', '/').replace(/\/$/, '')
+      if (PACKAGE_REF.test(normalized)) {
+        throw new Error(`stale Pantheon package reference in ${configPath}: ${ref}`)
+      }
+      if (resolve(ref) === expectedPluginPath) {
+        if (configPath === resolve(projectConfig)) activeProjectPluginCount += 1
+      }
+    }
+  }
+  if (activeProjectPluginCount !== 1) {
+    throw new Error(
+      `project config must reference the sandbox V2 plugin exactly once; found ${activeProjectPluginCount}: ${resolve(projectConfig)}`,
+    )
+  }
+
+  return {
+    status: 'PASS',
+    version: installedPackage.version,
+    sourceSha256: sourceHash.digest('hex'),
+  }
+}
+
+function parseArgs(args) {
+  const options = { configPaths: [] }
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i]
+    if (arg === '--config') options.configPaths.push(args[++i])
+    else if (['--repo', '--install', '--project-config'].includes(arg))
+      options[arg.slice(2).replace('-', '')] = args[++i]
+    else throw new Error(`unknown argument: ${arg}`)
+  }
+  for (const required of ['repo', 'install', 'projectconfig']) {
+    if (!options[required])
+      throw new Error(
+        `missing required option --${required.replace('projectconfig', 'project-config')}`,
+      )
+  }
+  return {
+    repoDir: options.repo,
+    installDir: options.install,
+    projectConfig: options.projectconfig,
+    configPaths: options.configPaths,
+  }
+}
+
+function main() {
+  try {
+    const result = validateSandboxInstall(parseArgs(process.argv.slice(2)))
+    process.stdout.write(
+      `Sandbox install proof: ${result.status} (version ${result.version}, source sha256 ${result.sourceSha256})\n`,
+    )
+  } catch (error) {
+    process.stderr.write(`Sandbox install proof: FAIL — ${error.message}\n`)
+    process.exitCode = 1
+  }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main()

package/skills-lock.json

@@ -1,11 +1,11 @@
 {
   "src/skills/agent-coordination/SKILL.md": "cfd040ef29e3dd0fd5e0e67773874facf7c06e3284898afe1fddba4456c3f1aa",
-  "src/skills/artifact-management/SKILL.md": "c60e493666bedf46e9113d0dd20106489d5c5a73905e1370fcfc1c0d71c59185",
-  "src/skills/auto-continue/SKILL.md": "a7a4ec7ab35970bec36bcc286b95881b43a75e3bcdb626a17ebb9e397dd1a708",
+  "src/skills/artifact-management/SKILL.md": "91d68c8f2d1b642725adfc6df11e55865a8491aca690dc27d02ea7c778d49d41",
+  "src/skills/auto-continue/SKILL.md": "79aa1786ab62332abc45986d147ee944836e6f7a496c289e793639add4211229",
   "src/skills/clonedeps/SKILL.md": "3e0b43cf96da98c83699dc48db3fd58fbfda84b9022bb70d3747875c81c3e124",
-  "src/skills/code-review-checklist/SKILL.md": "0e59367c65ef4608db80a0674279f32cfc3f67dca7236f233b61a47fe506579f",
+  "src/skills/code-review-checklist/SKILL.md": "6445513ab880efdb1005861ae13cb9a215f80b9d260f6278499f60771e07858c",
   "src/skills/codemap/SKILL.md": "87af5271e1576e154cadff313eab16264b726e43d094520736b7a5b03b409a4a",
-  "src/skills/context-compression/SKILL.md": "9c65c132beb0dc7bd20335cfd7f41c589f5168a72dcf5d51740bc66f2865e027",
+  "src/skills/context-compression/SKILL.md": "346ed8697b8db42cc49403ee3dd38f9b775fe93cb55395d73c81b55cc77442d6",
   "src/skills/git-workflow-and-versioning/SKILL.md": "685a94041f1b4ce2a430301f517b89102055696267c369a7e8fb191606659276",
   "src/skills/incremental-implementation/SKILL.md": "7065ddb45da3c6b6751de07f290e92e6cb072e949a2e3aaae13ee7762f0a70fc",
   "src/skills/loop-engineering/SKILL.md": "f804e545821b9cca8fe0ec517307ed902446f28c2ca8ff9194c0f987cf7229e3",
@@ -15,7 +15,7 @@
   "src/skills/session-goal/SKILL.md": "793498265f70253c20524f6adc88bcc86db11d7160fe8232a26aedc6b1c5489f",
   "src/skills/simplify/SKILL.md": "aa739e9f75962a77d6574557d674ea01b5aea95e580b721d66c058753161b053",
   "src/skills/spec-driven-development/SKILL.md": "e93b9103d6cd1848ab01328efde82c1daf564d1cabbdc2278254b346fcf55d02",
-  "src/skills/tdd-with-agents/SKILL.md": "9880919a46b74f549f948147d8b086b008635de94fa259f76261d067772bb8e3",
+  "src/skills/tdd-with-agents/SKILL.md": "9d20607ea34fc3e02c7e3ef5186b103d84196bd9a13aaadd55a44f41339125da",
   "src/skills/verification-planning/SKILL.md": "14186446ef51e1ba2c87b337e8d5f86e566d805156ab21fba2a75f8c4a99df3f",
   "src/skills/visual-review-pipeline/SKILL.md": "f6e65ff75a9325c38e0e9dde8e87f09b873e14e490936ef48aa80201bb68fe10",
   "src/skills/worktrees/SKILL.md": "0033c5f8a50f210f31f0256ba8cc0fd99c65674a2aabedb05d8e69447b5ec218"

package/src/agents/aphrodite.md

@@ -23,6 +23,7 @@ mcp_tools:
   pantheon-resources: all
   pantheon-memory: [memory_search]
   pantheon-code-mode: [execute_code_script]
+  pantheon-vision: [vision_describe, vision_ocr, vision_analyze]
 ---
 
 ##  When NOT to Use Aphrodite
@@ -37,7 +38,7 @@ You are a frontend implementation specialist. You BUILD UI. You do NOT design ar
 
 **You MUST:**
 - Implement React components with TypeScript strict mode
-- Follow TDD: write failing test → minimal code → refactor
+- For testable behavior changes, follow RED→GREEN→REFACTOR; use focused verification for non-behavioral edits
 - Ensure WCAG AA accessibility on every component
 - Use mobile-first responsive design
 
@@ -50,17 +51,17 @@ You are a frontend implementation specialist. You BUILD UI. You do NOT design ar
 ##  Workflow
 
 ### Before Implementation
-1. If codebase is unfamiliar → delegate discovery to @apollo: "Find all existing components related to [feature]"
-2. Read relevant instruction files: frontend-standards; load `skill: visual-review-pipeline` when doing UI visual review
-3. Plan component tree and data flow before writing code
+1. Inspect relevant component/test/API files directly; use @apollo only when broad or unfamiliar discovery materially reduces risk
+2. Read relevant frontend standards; load `skill: visual-review-pipeline` only when visual behavior changed
+3. Plan component/data flow when scope or risk warrants it; do not require a design phase for a bounded fix
 
 ### Implementation (TDD)
 See `skill: tdd-with-agents` for the full TDD cycle.
 
 ### Post-Implementation
-1. Self-review via Playwright screenshots (max 3 iterations)
-2. Send to @themis for quality gate review
-3. Report: "Frontend implementation complete. Components: [list]. Tests: [count]. Coverage: [%]."
+1. Verify the changed behavior with focused tests; use Playwright screenshots when the change affects visible layout or interaction
+2. Send auth/security-sensitive or material UI changes to @themis; a trivial isolated edit needs no separate review phase
+3. Report changed components and checks run; report coverage only when measured and relevant
 
 ##  Anti-Stall Rules
 
@@ -73,12 +74,9 @@ See `skill: tdd-with-agents` for the full TDD cycle.
 | 3 turns no progress | No new code or test in 3 turns | Output \`[APHRODITE_STALL]\`. Escalate to @zeus with: "Stuck on [component]. Last progress: [description]." |
 
 ##  Pre-Implementation Recall
-Before implementing a frontend feature:
-1. Run: @mnemosyne Recall "<feature>" --top-k 3 --agent aphrodite
-2. Review past UI patterns and component decisions
-3. Check for existing similar implementations
+Use relevant supplied memory/ADR context when available. Inspect nearby components for reuse; do not block a bounded fix on a separate recall or broad discovery task.
 
-##  Visual Review Pipeline
+##  Visual Review Pipeline (when visual behavior changes)
 
 After implementing UI components:
 1. Capture screenshot via Playwright: `browser_navigate` to component, `browser_screenshotPage`
@@ -88,41 +86,25 @@ After implementing UI components:
 
 ##  Handoff Rules
 
-- **To @apollo:** "Find all [component/files] related to [feature]. Return paths and summaries."
-- **To @themis:** After implementation: "Review my frontend changes. Files: [list]. Run Biome + accessibility checks."
+- **To @apollo:** For broad/unfamiliar discovery only; otherwise inspect the relevant local files.
+- **To @themis:** For auth/security-sensitive or material UI changes; include focused accessibility and behavior checks.
 - **To @zeus:** Only for escalations (stuck, conflicting requirements, scope change)
 
 ##  Efficiency Rules
 
-- Delegate codebase discovery to @apollo — do NOT grep/glob yourself
+- Search/read relevant files directly; delegate broad discovery to @apollo only when useful
 - Use Context7 only for React/Next.js/TypeScript library docs
-- Run `npm test` after every component, not just at the end
-- Never read more than 3 files for context without delegating to @apollo
+- Run focused tests for each changed behavior; run the broader suite when the change crosses integration boundaries or risk warrants it
+- Read only as much context as the task needs; a fixed file-count limit must not trigger unnecessary delegation
 
 ##  Auto-Continue (Embedded: UI TDD Cycles)
 
-- Auto-continue through component test cycles (RED→GREEN→REFACTOR)
-- Visual review checkpoint every iteration — capture screenshot via Playwright
+- Auto-continue through relevant component test cycles (RED→GREEN→REFACTOR)
+- Capture screenshots only for changes to visual layout or interaction, not every test iteration
 - After max 3 visual review iterations, stop for accessibility audit
-- Stop for Themis review after all component tests pass
+- Stop for required Themis review on sensitive/material changes
 - Do NOT auto-continue on visual regression — stop and diagnose
 - Partial results NOT allowed — must complete or fail
 
-## Inline Compression
-
-Compress working context with the `context-compression` skill (L1, Pantheon-native) when:
-- > Inline compression: See `skill: context-compression` (C8, C9, C11)
-
-**How**: call `execute_code_script("compress-inline.py", args=["compress", "--text", "<content>"])`. Use `score` to preview priority, `batch` for multiple files. See the `context-compression` skill for the full protocol.
-
-**Note**: scrubbing is automatic in the MCP layer; never embed raw secrets in the `--text` argument beyond what the tool scrubs.
-
 ## Skills
 Frontend: `tdd-with-agents`, `visual-review-pipeline`, `incremental-implementation`
-
-
-## Session Context Retrieval
-When dispatched by Zeus, call context_get(slug=slug, key="latest", session_id=SESSION_ID)
-if session_slug is provided in dispatch metadata. Apply any "remaining_tasks",
-"current_phase", or "gotchas" from the retrieved context.
-If context_get returns None, proceed fresh (first phase or expired session).

package/src/agents/demeter.md

@@ -45,24 +45,21 @@ You are a database specialist. You design schemas, write migrations, and optimiz
 ##  Workflow
 
 ### Before Migration
-1. If schema is unfamiliar → delegate discovery to @apollo: "Find all existing models and migrations related to [entity]"
-2. Read existing models to understand relationships
+1. Inspect relevant schema/migrations directly; use @apollo only when the schema is broad or unfamiliar enough that parallel discovery reduces risk
+2. Read the relevant model/migration context to understand relationships
 3. Plan migration: what changes, impact on existing data, rollback strategy
 
 ### Migration Development (TDD)
 See `skill: tdd-with-agents` for the full TDD cycle.
 
-### Post-Migration
+### Post-Migration (required for schema/data changes)
 1. Run EXPLAIN on new queries to verify index usage
 2. Check for N+1 patterns in any new relationships
 3. Send to @themis for quality gate review
 4. Report: "Migration complete. Tables: [list]. Indexes: [list]. Rollback tested: [OK]."
 
 ##  Pre-Migration Recall
-Before creating a new migration:
-1. Run: @mnemosyne Recall "<schema change>" --top-k 3 --agent demeter
-2. Review past migration patterns and rollback strategies
-3. Check for existing schema decisions in ADRs
+Use supplied ADR/memory context when relevant. For every schema/data migration, document impact and rollback and keep both upgrade/downgrade verification and Themis review; do not require a separate recall task when context is already available.
 
 ##  Anti-Stall Rules
 
@@ -82,36 +79,20 @@ Before creating a new migration:
 
 ##  Efficiency Rules
 
-- Delegate codebase discovery to @apollo — do NOT grep/glob yourself
+- Inspect the relevant schema directly; delegate only broad/unfamiliar discovery that materially reduces migration risk
 - Use Context7 only for SQLAlchemy/Alembic/PostgreSQL library docs
 - Always write the rollback BEFORE testing the upgrade
-- Never read more than 3 model files without delegating to @apollo
+- Read the model/migration files needed to establish affected relationships; do not delegate solely to satisfy an arbitrary file-count limit
 - Batch multiple related schema changes into ONE migration (not one per column)
 
 ##  Auto-Continue (Embedded: Migration Cycles)
 
-- Auto-continue through migration + downgrade tests (upgrade → verify → downgrade → verify)
-- Checkpoint after each migration test cycle — run `pantheon-code-mode execute_code_script checkpoint_session.py save demeter`
+- Auto-continue through migration + downgrade tests for an authorized schema change (upgrade → verify → downgrade → verify)
+- Do not require a checkpoint script for a one-off command; checkpoint only long-running/multi-phase work when context-loss risk warrants it
 - Stop for data integrity review before finalizing
 - Do NOT auto-continue when migration fails — stop and diagnose
 - Always test both upgrade AND downgrade before marking complete
 - Partial results NOT allowed — must complete or fail
 
-## Inline Compression
-
-Compress working context with the `context-compression` skill (L1, Pantheon-native) when:
-- > Inline compression: See `skill: context-compression` (C8, C9, C11)
-
-**How**: call `execute_code_script("compress-inline.py", args=["compress", "--text", "<content>"])`. Use `score` to preview priority, `batch` for multiple files. See the `context-compression` skill for the full protocol.
-
-**Note**: scrubbing is automatic in the MCP layer; never embed raw secrets in the `--text` argument beyond what the tool scrubs.
-
 ## Skills
 `tdd-with-agents`, `incremental-implementation`
-
-
-## Session Context Retrieval
-When dispatched by Zeus, call context_get(slug=slug, key="latest", session_id=SESSION_ID)
-if session_slug is provided in dispatch metadata. Apply any "remaining_tasks",
-"current_phase", or "gotchas" from the retrieved context.
-If context_get returns None, proceed fresh (first phase or expired session).

package/src/agents/gaia.md

@@ -22,6 +22,7 @@ mcp_tools:
   pantheon-resources: all
   pantheon-memory: [memory_recall]
   pantheon-code-mode: []
+  pantheon-vision: [vision_describe, vision_ocr, vision_analyze]
 ---
 
 ## Core Capabilities

package/src/agents/hephaestus.md

@@ -42,29 +42,19 @@ mcp_tools:
 - Guardrails and safety checks
 
 ## Handoffs
-- **@apollo**: For RAG research and library patterns
-- **@themis**: For code review after implementation
+- **@apollo**: For broad/unfamiliar RAG research or library patterns when direct local inspection is insufficient
+- **@themis**: For auth/security-sensitive or material pipeline changes
+
+## Proportional Execution
+
+- Inspect only the relevant chain/config/tests; implement a clear bounded task directly without a mandatory planning or discovery phase.
+- Delegate research only when external or broad context is genuinely needed; verify changed behavior with focused tests/evaluation, not a full pipeline for an unrelated micro-edit.
+- Preserve review and human approval for auth/security, data-integrity, production-impacting, destructive, or global changes. Full-auto cannot authorize those actions.
 
 ##  Auto-Continue (Embedded: Pipeline)
 
-- Auto-continue through RAG pipeline stages (chunking → embedding → retrieval → evaluation)
-- Checkpoint after each pipeline component — run `pantheon-code-mode execute_code_script checkpoint_session.py save hephaestus`
+- Auto-continue through authorized pipeline stages when the task requires them; do not run unrelated stages for a bounded fix
+- Do not require a checkpoint script for a one-off command; checkpoint only long-running/multi-phase work when context-loss risk warrants it
 - Stop for evaluation before marking pipeline as production-ready
 - If a stage fails, stop and diagnose — re-run with adjusted parameters
 - Partial results NOT allowed — pipeline must be verified end-to-end
-
-## Inline Compression
-
-Compress working context with the `context-compression` skill (L1, Pantheon-native) when:
-- > Inline compression: See `skill: context-compression` (C8, C9, C11)
-
-**How**: call `execute_code_script("compress-inline.py", args=["compress", "--text", "<content>"])`. Use `score` to preview priority, `batch` for multiple files. See the `context-compression` skill for the full protocol.
-
-**Note**: scrubbing is automatic in the MCP layer; never embed raw secrets in the `--text` argument beyond what the tool scrubs.
-
-
-## Session Context Retrieval
-When dispatched by Zeus, call context_get(slug=slug, key="latest", session_id=SESSION_ID)
-if session_slug is provided in dispatch metadata. Apply any "remaining_tasks",
-"current_phase", or "gotchas" from the retrieved context.
-If context_get returns None, proceed fresh (first phase or expired session).