feat: runtime smoke test, gitea actions workflows, runtime-checks record

.opencode/state/status.md

@@ -1,46 +1,58 @@
 # Project status
 
-Updated: 2026-10-14 (phase 0 — analysis)
+Updated: 2026-10-14 (phase 1 implementation, ~90% done)
 
 ## Current phase
 
-Phase 0 (analysis) — COMPLETE. Phase 1 (plugin package) ready to start at TODO 1.1.
+Phase 1 (plugin package) — implementation complete and runtime-verified locally. Remaining:
+first registry release (1.10) + Gitea secret provisioning, then Phase 2.
 
 ## Done
 
-- Repo bootstrapped (was empty; Gitea remote `haylan/mattpocock-skills-opencode` configured).
-- Studied reference repos (cloned to temp, not vendored):
-  - `fastcrw-opencode-websearch` — V2 plugin shape, Gitea release script/workflows, test style
-    (`node --test` on .ts), prettier/tsconfig conventions.
-  - `mcdays94/pocock-agents` — proven orchestrator/worker agent pair (V1-era, tracks upstream v1.3
-    `d81f3a1`), drift-check script, Docker smoke test.
-  - `mattpocock/skills` @ `49dd158` (2026-10-09, v1.3.1) — all 38 SKILL.md files read in full by a
-    subagent: frontmatter census (only name/description/disable-model-invocation×23/argument-hint×4/
-    metadata.credits×1), dependency graph, subagent census, 17 pending patch changesets.
-- Verified OpenCode V2 API surface against docs + `anomalyco/opencode@dev` source + installed
-  `@opencode/plugin@2.0.29` typings (see AGENTS.md "Key V2 facts").
-- Wrote: AGENTS.md, state files (upstream/decisions D1–D8/classification.json), TODO.md,
-  docs/architecture.md, docs/skill-mapping.md (31 vendored + 7 excluded skills classified).
+- Phase 0 analysis complete: architecture, 38-skill classification matrix, decisions D1–D8,
+  verified V2 API surface (docs + `@opencode/plugin@2.0.29` typings + live runtime).
+- Package scaffolded: `@haylan/opencode-pocock` (name confirmed by owner), TS ESM, prettier,
+  `node --test` on .ts, MIT + NOTICE attributions (Matt Pocock, Dex Horthy, mcdays94, fastcrw).
+- `scripts/sync-upstream.ts`: pristine snapshot vendoring @49dd158 (v1.3.1, 38 skills), early exit
+  on no-change, needs-review classification entries for new skills, previous_commit/last_diff in
+  state for the changelog generator.
+- `scripts/generate.ts`: skills/ tree (verbatim, minus agents/openai.yaml), manifest.json (31
+  skills, autoinvoke from upstream DMI), docs/skill-mapping.md matrix between markers.
+- Plugin `src/index.ts` (id `haylan.pocock`): injects all manifest skills (frontmatter-stripped
+  content, absolute package paths), opt-in `guardrails` tool hook (upstream pattern list ported),
+  agent missing/stale warning via `.pocock-version` stamp. Fails loudly on bad options.
+- `src/init.ts` bin: copies agents to project/global agents dir, never clobbers modified files
+  without --force, stamps version.
+- Agents (V2-native frontmatter only): `pocock` (primary orchestrator, worktree dispatch loop),
+  `pocock-worker` (subagent, skill allow-list tdd/codebase-design/diagnosing-bugs, git/gh denies,
+  no subagents), `pocock-reviewer` (subagent, read-only code-review axis executor).
+- Release pipeline: `scripts/version.ts` (changelog-driven minor bump, idempotent per upstream
+  SHA) + `scripts/release.ts` (Gitea npm registry publish via HTTP, tag, package link; adapted
+  from fastcrw) + CHANGELOG.md with 0.1.0 prepared.
+- Workflows: check.yml (PR+push), nightly.yml (sync→generate→format/check/test/build→version→
+  commit-back→publish+tag+link, secrets-only), smoke.yml (dispatch-only, installs opencode).
+- `scripts/smoke.ts` — PASS on opencode v2.0.29: plugin active, 31 skills registered (16 hidden),
+  agents decoded with full permission arrays. Findings: docs/runtime-checks.md.
+- Test suite: 32 unit/integration tests green (parser, generator+real-snapshot regression, sync
+  diff, plugin fake-ctx, init, drift gates, release/version helpers).
 
 ## Known gaps / risks
 
-- Unverified at runtime: exact `Skill.Info` field set accepted by `editor.add` (docs show
-  id/name/description/path/content + autoinvoke; confirm against installed `@opencode/plugin`
-  typings in Phase 1). Same for `permissions` array frontmatter in agent .md — verify with a real
-  `opencode serve` smoke.
-- Background subagents: V1 needed `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS=true`; V2 status
-  unknown — orchestrator must work in batch mode either way.
-- `request.body` overlays are accepted but not sent by the V2 runner yet — don't rely on
-  temperature tuning.
-- Nightly commit-back to main needs a Gitea token with repo write scope (same `PACKAGE_TOKEN`
-  pattern as fastcrw, which used it for tags + package link).
+- 1.10 not done: package never published to the Gitea registry yet; npm-name plugin entry
+  (resolving through `exports`) unverified — local directory entry verified instead.
+- `PACKAGE_TOKEN` Gitea secret must be provisioned by the repo admin before nightly can publish
+  or commit back.
+- Nightly runner network access to github.com unverified (fallback: Gitea mirror of upstream).
+- Windows-only smoke quirk: fixture temp dir deletion can lag (EPERM warning, harmless); CI is
+  Linux.
+- Background subagents in V2 (env-gated in V1) not verified; orchestrator text works either way.
+- `request.body` overlays accepted but not sent by the V2 runner — agents avoid them.
 
 ## Next steps (exact)
 
-1. Phase 1.1: scaffold package (package.json `@haylan/opencode-pocock` — confirm scope with owner,
-   tsconfig, prettier, .gitignore, MIT LICENSE + upstream attribution, README stub).
-2. Phase 1.2: scripts/sync-upstream.ts + vendor upstream/ @49dd158 (strip non-skill files: keep
-   skills/{engineering,productivity,misc}/** minus agents/openai.yaml; write UPSTREAM.json).
-3. Phase 1.6 note: agent templates = port pocock.md/pocock-worker.md from mcdays94/pocock-agents
-   (temp clone path in status history) to V2-native frontmatter + add pocock-reviewer; update
-   stack-skills table to be user-editable; worker skill allow-list from classification.json.
+1. Run `npm run format`, `npm run check`, `npm test`, `npm run build`; commit workflows/smoke/docs.
+2. Push to origin; ask owner to add `PACKAGE_TOKEN` secret (write:package + write:repository).
+3. 1.10: `node scripts/release.ts` with SERVER_URL/REPOSITORY/SHA/TOKEN env (or dispatch a manual
+   release workflow) → verify `plugins: ["@haylan/opencode-pocock"]` installs from the registry in
+   a clean fixture; record in docs/runtime-checks.md.
+4. Phase 2 per TODO.md (2.2 guardrails already implemented in 1.4 — verify mapping note; 2.4–2.7).