feat: add phase 3 hybrid orchestration policy kernel

.github/workflows/ci.yml

@@ -61,7 +61,21 @@ jobs:
         run: npm run validate:budget
 
       - name: Check feature integration contract
-        run: npm run validate:feature
+        id: feature-contract
+        shell: bash
+        run: |
+          set +e
+          npm run validate:feature 2>&1 | tee feature-contract.log
+          status=${PIPESTATUS[0]}
+          set -e
+          exit "$status"
+
+      - name: Upload feature-contract diagnostics
+        if: failure() && matrix.node-version == 22
+        uses: actions/upload-artifact@v4
+        with:
+          name: feature-contract-node-22
+          path: feature-contract.log
 
       - name: Check documentation links
         run: node scripts/check-doc-links.mjs

.github/workflows/cross-platform.yml

@@ -56,7 +56,19 @@ jobs:
           name: runtime-test-${{ matrix.os }}-node-${{ matrix.node-version }}
           path: runtime-test.log
       - name: Test plugin integration
-        run: node tests/tool-integration-tests.mjs
+        shell: bash
+        run: |
+          set +e
+          node tests/tool-integration-tests.mjs 2>&1 | tee plugin-integration.log
+          status=${PIPESTATUS[0]}
+          set -e
+          exit "$status"
+      - name: Upload plugin-integration diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: plugin-integration-${{ matrix.os }}-node-${{ matrix.node-version }}
+          path: plugin-integration.log
       - name: Test bypass detection
         run: node tests/bypass-detection.mjs
       - name: Test installer in POSIX shell

.opencode/command/feature.md

@@ -1,48 +1,33 @@
 ---
 agent: orchestrator
 description: >
-  Run the full agent workflow for a feature, fix, refactor, migration,
-  documentation, or UI change. The orchestrator inspects, plans, obtains
-  approval, then drives baseline, smoke, build, test, review, and escalation
-  through budget-enforced agent_loop calls before creating a local commit.
+  Run a feature, fix, refactor, migration, documentation, or UI change through
+  the hybrid policy kernel, budgeted agent_loop workers, independent review,
+  and a policy-controlled local commit.
 ---
 
-# /feature — Autonomous feature workflow
+# /feature — Policy-constrained autonomous workflow
 
-Run the complete OpenCode agent lifecycle for a single unit of work.
+Create one stable `taskId`, inspect and plan the work, and retain semantic control over the next useful action.
 
-## Required execution pattern
+Before every delegated action and before commit:
 
-Create one stable `taskId` after approval and reuse it for every `agent_loop` call. Do not use the built-in `task` tool, because it bypasses routing, failover, and budget enforcement.
+1. Call `orchestration_policy` with the proposed action, reason, risk, paths, and available evidence.
+2. On `allow`, pass the returned one-time `policyPermit` to `agent_loop` or `orchestration_commit`.
+3. On `needs_evidence`, gather the requested evidence, record it, replan, or ask the user.
+4. On `deny`, do not repeat the same proposal or bypass the kernel.
 
-All delegated roles run sequentially in the shared working tree. Do not parallelize workers until isolated worktrees and deterministic reconciliation are implemented.
+The orchestrator may choose baseline, justified baseline skip, smoke, build, test-only, review, fix, escalation, replanning, user clarification, or stop. The kernel enforces approval, stable identity, budgets, retry/fix limits, risk gates, staged-candidate identity, and final commit authorization.
 
-## Workflow
+Risk-based final evidence:
 
-1. **PLANNING** — Read `AGENTS.md`, inspect repository status and affected code, discover validation commands, define acceptance criteria, and produce a concise plan.
-2. **AWAITING_APPROVAL** — Present the plan and wait for explicit approval.
-3. **BASELINE_TESTING** — Create the stable task ID and delegate a pre-change test pass. Record current failures and the behavior the implementation must change.
-4. **SMOKE_TESTING** — Test the relevant free model pool and retain responsive model IDs.
-5. **IMPLEMENTING** — Delegate one build role at a time. Do not edit code yourself.
-6. **VERIFYING** — Delegate the test role and compare results with the baseline.
-7. **STAGING_FOR_REVIEW** — Stage only intended implementation, test, and documentation files with explicit pathspecs. Verify the staged file list and `git diff --cached --check`.
-8. **REVIEWING** — Delegate the independent read-only reviewer against the current staged candidate. Empty, incomplete, or unrelated staged changes are `BLOCKED`, never `PASS`.
-9. **FIXING** — Combine findings into one bounded build request. After each fix, rerun tests, restage the complete candidate, and rerun review. Maximum two fix cycles.
-10. **ESCALATING** — Escalate only non-budget blockers and retain the same task ID.
-11. **READY_TO_COMMIT** — Confirm the exact staged candidate received final test and review PASS, contains no secrets or unrelated files, and has not changed since review.
-12. **COMPLETED** — Create one focused local commit, account for test-owned background processes, and produce the final evidence and budget report.
+- low — relevant validation and independent review
+- medium — baseline or justified skip, focused test, review
+- high — baseline, runtime and integration evidence, review, recovery evidence when applicable
+- critical — high-risk evidence plus isolation and a final human checkpoint
 
-## Hard rules
+Stage only intended files, propose `stage_candidate`, and bind final test and review evidence to the returned candidate hash. After any candidate change, restage and repeat final verification.
 
-- Test before and after implementation.
-- Never allow the builder to approve its own implementation.
-- Never commit unless tests and independent review pass on the current staged candidate.
-- Never push without asking the user first.
-- Never mix pre-existing staged changes into the feature review or commit.
-- Never use `git add .` or `git add -A` when unrelated changes exist.
-- One active delegated role at a time.
-- The orchestrator does not write code; delegate implementation.
-- After every fix cycle, rerun VERIFYING, STAGING_FOR_REVIEW, and REVIEWING.
-- `BUDGET_EXCEEDED` is terminal. Do not retry, escalate, or generate a replacement task ID.
+Never use the built-in `task` tool, direct `git commit`, automatic push, parallel workers in one shared worktree, fabricated evidence, or a replacement task ID after budget exhaustion.
 
-See `agents/orchestrator.md` for the complete execution contract.
+See `agents/orchestrator.md` for the complete contract.