feat: runtime smoke test, gitea actions workflows, runtime-checks record

TODO.md

@@ -19,19 +19,19 @@ State: `.opencode/state/status.md`. Design: `docs/architecture.md`.
 
 ## Phase 1 — plugin package
 
-- [ ] 1.1 scaffold package (package.json name @haylan/opencode-pocock — CONFIRM scope with repo
-      owner, tsconfig, prettier, .gitignore, MIT LICENSE + upstream attribution, README stub)
-- [ ] 1.2 scripts/sync-upstream.ts + vendor upstream/ @49dd158 + state update
-- [ ] 1.3 scripts/generate.ts: manifest.json + skills/ output + unit tests (parser, manifest)
-- [ ] 1.4 src/index.ts plugin: skill injection, options validation, agent-staleness warning +
-      fake-ctx integration tests (verify Skill.Info fields against installed @opencode/plugin typings!)
-- [ ] 1.5 bin init (copy agents, -g global, no silent overwrite) + tests
-- [ ] 1.6 agent-templates/: port pocock + pocock-worker from pocock-agents to V2-native frontmatter
-      (permissions array, shell action, no legacy keys); generate agents/*.md; drift tests
-- [ ] 1.7 scripts/release.ts + version.ts adapted from fastcrw + unit tests
-- [ ] 1.8 .gitea/workflows/: check.yml, nightly.yml, smoke (dispatch); smoke.ts against opencode serve
-- [ ] 1.9 local runtime verification (serve + HTTP API: plugin ok, skills visible, autoinvoke flags,
-      agents after init, worker denies hold) → docs/runtime-checks.md
+- [x] 1.1 scaffold package (`@haylan/opencode-pocock` confirmed by owner 2026-10-14)
+- [x] 1.2 scripts/sync-upstream.ts + vendor upstream/ @49dd158 + state update
+- [x] 1.3 scripts/generate.ts: manifest.json + skills/ output + unit tests (parser, manifest)
+- [x] 1.4 src/index.ts plugin: skill injection (frontmatter-stripped content), options validation,
+      agent-staleness warning + fake-ctx integration tests (Skill.Info verified: cast needed for
+      effect-branded fields; runtime PASS)
+- [x] 1.5 bin init (copy agents, -g global, no silent overwrite, .pocock-version stamp) + tests
+- [x] 1.6 agents/: pocock + pocock-worker + pocock-reviewer, V2-native frontmatter; drift tests
+      (upstream names, worker skill allow-list, reviewer read-only, no subagent recursion)
+- [x] 1.7 scripts/release.ts + version.ts adapted from fastcrw + unit tests
+- [x] 1.8 .gitea/workflows/: check.yml, nightly.yml, smoke.yml (dispatch); scripts/smoke.ts —
+      PASS on v2.0.29 (plugin active, 31 skills, 16 hidden, agents + permissions decoded)
+- [x] 1.9 local runtime verification → docs/runtime-checks.md (findings folded into README/AGENTS)
 - [ ] 1.10 manual release 0.1.0 to Gitea registry; verify install-from-registry by package name
 - [ ] ask repo admin to add Gitea secret PACKAGE_TOKEN (write:package + write:repository)
 
@@ -51,12 +51,15 @@ State: `.opencode/state/status.md`. Design: `docs/architecture.md`.
 
 - ~~Exact `Skill.Info`/editor.add field set~~ RESOLVED 2026-10-14 (`@opencode/plugin@2.0.29`):
   `{id, name, description?, autoinvoke?, path, content}`; no `slash` in Info.
-- V2 background subagents: still env-gated? Affects orchestrator dispatch loop wording (1.6).
-- Do plugin-injected skills get `/name` slash exposure (no `slash` field in Skill.Info)? Runtime
-  check at 1.9; fallback = document `skills: ["<pkg-dir>/skills"]` config entry for file-based load.
-- Package name/scope confirmation (1.1).
+- V2 background subagents: still env-gated? Affects orchestrator dispatch loop wording only
+  (agent text covers both modes) — low priority, observe at 2.5.
+- ~~Slash exposure for injected skills~~ RESOLVED: none (runtime check 2026-10-14); README
+  documents file-based alternatives.
+- Package name/scope: CONFIRMED `@haylan/opencode-pocock` (owner, 2026-10-14).
 - Does nightly runner have network access to github.com for upstream fetch? (1.8 — fallback: mirror
-  upstream to Gitea and sync from the mirror.)
+  upstream to Gitea and sync from the mirror.) Verify on first nightly run.
+- Install-from-registry by package name (npm-name plugin entry resolving through `exports`) —
+  verify at 1.10; local dir entry verified.
 
 ## Done log