feat(dag): unify workflow authoring and blocks

.github/workflows/release-fork.yml

@@ -89,31 +89,40 @@ jobs:
   # (LeXwDeX/opencode-dag-config) into a release asset. dev/main do not manage
   # these templates anymore — the config repo is the single source of truth.
   # Read-only: no commits, no pushes, so branch protection never blocks it.
+  #
+  # Validate-before-package: the releasing runtime commit runs its directory
+  # validator against the config repo HEAD BEFORE any copy/package step. Any
+  # invalid template — or an unavailable validator — fails the job (fail
+  # closed), so an unchecked archive can never be uploaded or embedded.
   package-templates:
     name: Package Reference Templates
     if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
+      - name: Checkout Runtime (releasing commit)
+        uses: actions/checkout@v4
+
       - name: Clone Config Repo
         uses: actions/checkout@v4
         with:
           repository: LeXwDeX/opencode-dag-config
           path: dag-config
 
-      - name: Package Templates
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+        with:
+          save-cache: false
+
+      - name: Install Runtime Dependencies
+        run: bun install
+
+      - name: Validate and Package Templates (fail closed)
+        working-directory: packages/opencode
         run: |
-          mkdir -p dist
-          shopt -s nullglob
-          files=(dag-config/*.yaml)
-          if [ ${#files[@]} -gt 0 ]; then
-            cp "${files[@]}" dist/
-          else
-            echo "::warning::No templates found in opencode-dag-config root; packaging empty archive"
-          fi
-          tar -czf dag-templates.tar.gz -C dist .
-          echo "Templates packaged: $(ls dist | wc -l) files"
+          echo "Packaging config commit $(git -C "$GITHUB_WORKSPACE/dag-config" rev-parse HEAD) with runtime commit $(git rev-parse HEAD)"
+          bun run script/package-dag-templates.ts "$GITHUB_WORKSPACE/dag-config" "$GITHUB_WORKSPACE/dag-templates.tar.gz"
 
       - name: Upload Templates Artifact
         uses: actions/upload-artifact@v4
@@ -224,15 +233,9 @@ jobs:
           for dir in opencode-*/; do
             base="${dir%/}"
             if [[ "$base" == *linux* ]]; then
-              tar -czf "${base}.tar.gz" -C "${base}/bin" .
+              bun run ../script/package-cli-artifact.ts "$base" "${base}.tar.gz"
             else
-              cd "${base}/bin"
-              if command -v zip &>/dev/null; then
-                zip -r "../../${base}.zip" .
-              else
-                pwsh -Command "Compress-Archive -Path '*' -DestinationPath '../../${base}.zip'" 2>/dev/null || 7z a "../../${base}.zip" . || true
-              fi
-              cd ../..
+              bun run ../script/package-cli-artifact.ts "$base" "${base}.zip"
             fi
           done
 

CONTEXT-MAP.md

@@ -5,7 +5,8 @@ Read the context documents relevant to the code or decision under review. Do not
 | Context | Domain document | Primary areas |
 | --- | --- | --- |
 | Session Runtime and Client Contract | [`CONTEXT.md`](CONTEXT.md) | `packages/opencode/src/session`, `packages/opencode/src/system-context`, `packages/protocol`, `packages/client`, `packages/sdk` |
+| Workflow Orchestration | [`packages/opencode/src/dag/CONTEXT.md`](packages/opencode/src/dag/CONTEXT.md) | `packages/opencode/src/dag`, workflow tool, DAG template validation and packaging |
 
 ## Contexts created lazily
 
-DAG orchestration does not yet have a dedicated `CONTEXT.md`. The full DAG review must establish terminology from implementation, tests, existing specifications, and accepted decisions before `/domain-modeling` creates one. Add future contexts to this map only when they have a stable document to reference.
+Add future contexts to this map only when they have a stable document to reference.

NOTICE

@@ -51,3 +51,16 @@ License boundaries
 When a file under an AGPL-covered directory imports MIT-licensed upstream
 modules, the upstream modules remain MIT; only the AGPL-covered files and
 their derivatives carry AGPL obligations.
+
+3. Engineering workflow methodologies
+
+   Source:   https://github.com/mattpocock/skills
+   Revision: 84fdeffd12f2ee307994d1eb6feb48173b6e0502
+   License:  MIT
+   Text:     ./third_party/mattpocock-skills/LICENSE
+   Copyright (c) 2026 Matt Pocock
+
+   Selected decision, evidence, debugging, test-first delivery, codebase
+   design, review, and synthesis methodologies are adapted into product-owned
+   workflow routing and block contracts. Source metadata and adaptation scope
+   are recorded in ./third_party/mattpocock-skills/SOURCE.md.

packages/core/src/plugin/command/dag-flow.txt

@@ -4,17 +4,10 @@
 $ARGUMENTS
 </dag-flow-task>
 
-If the task is empty or contains only whitespace, ask for it and do not start a workflow. Otherwise load
-the `orchestration-router` skill and route the request through one consolidated
-graph. `/dag-flow` explicitly selects DAG execution, but it does not waive a
-material user decision.
-
-When the route requires a decision checkpoint or GRILL qualification, inspect
-discoverable facts first, proactively write recommended answers, surface the
-compact brief in the main conversation, and ask for one combined confirmation.
-Do not call `workflow(action="start")` until that confirmation arrives. Do not
-put the checkpoint in a child node. If the request is already bounded and
-confirmed, start without manufacturing another question.
+If the task is empty or contains only whitespace, ask for it; do not start a workflow.
+Otherwise apply the resident Orchestration Router and route the
+request through one consolidated graph. `/dag-flow` explicitly selects DAG
+execution; the router still owns any material Decision Checkpoint.
 
 Prefer composable blocks for a fresh flow. Load
 `workflow(action="guide", topic="blocks")` only if the block contract is not

packages/core/src/plugin/command/dag-template-update.txt

@@ -33,7 +33,7 @@ https://codeload.github.com/LeXwDeX/opencode-dag-config/zip/refs/heads/main
 ```
 
 Extract it into a temporary directory. The archive contains a top-level folder
-(typically `opencode-dag-config-main/`) whose root holds the `*.yaml`
+(typically `opencode-dag-config-main/`) whose root holds the `*.yaml` and `*.yml`
 templates.
 
 ## Dry-run preview (always show before applying)
@@ -48,6 +48,28 @@ Compare the extracted templates against the current
 
 Show the user the three lists, or report that nothing needs updating.
 
+## Validate downloaded templates (fail closed, before any replacement)
+
+Before any copy or overwrite, discover and validate EVERY extracted `*.yaml` and `*.yml` template with
+the same validation authority `start` and `list` use — the workflow tool's
+`validate` action. For each extracted template call:
+
+```
+workflow(action: "validate", spec_path: "<absolute path of the extracted file>", profile: "portable")
+```
+
+- Every template must come back `valid: true`.
+- If both `<name>.yaml` and `<name>.yml` exist, abort before applying anything;
+  one logical workflow name cannot have two source files.
+- If ANY template is invalid: keep the current global library exactly as it
+  is — copy nothing, overwrite nothing. Report a per-file diagnostic list
+  (code, path, message, hint) for every failing template plus the names that
+  passed, and stop. Treat validation failure like a download failure: never
+  partially apply.
+- Use the portable profile: the global library doubles as the distributable
+  builtin source, so a template that only works inside one specific project
+  does not belong here.
+
 ## Merge
 
 - If there are no `UPDATE` entries: merge directly — copy `NEW` templates in,
@@ -94,6 +116,8 @@ not just the workflow library listing:
 - Download failure (network, 404, rate limit): report the actual error
   verbatim and stop — never invent success.
 - Extraction failure (corrupt archive): report and stop.
+- Validation failure (any template invalid): report per-file diagnostics and
+  stop; the existing library stays untouched.
 - If `<config dir>/workflows` does not exist, create it before applying.
 
 ## Notes

packages/core/src/plugin/command/workflow-blocks.md

@@ -17,31 +17,26 @@ config:
     - id: map
       kind: explore
       instruction: Locate the ownership and persistence seams.
-    - id: design
+    - id: codebase-design
       kind: plan
       depends_on: [map]
-    - id: implement
+      instruction: Define the owning seam, deep interface, migration path, and acceptance evidence.
+    - id: coding
       kind: coding
-      depends_on: [design]
-      skills: [tdd]
-    - id: checks
+      depends_on: [codebase-design]
+      instruction: Deliver the bounded design through observable tests and focused checks.
+    - id: verify
       kind: verify
-      depends_on: [implement]
-    - id: decision
+      depends_on: [coding]
+    - id: global-review
       kind: review
-      depends_on: [checks]
-      skills: [code-review]
+      depends_on: [verify]
 ```
 
-Each block accepts:
-
-- `id`: unique dependency address and the ID of its compiled exit node.
-- `kind`: `explore`, `plan`, `prototype`, `debug`, `coding`, `verify`,
-  `review`, or `synthesize`.
-- `depends_on`: upstream block IDs; omitted means a root block.
-- `instruction`: target-specific text added to the built-in block contract.
-- `skills`: relevant skill names the child loads lazily when available.
-- `worker_type`, `required`, `report_to_parent`: optional overrides.
+The parameter schema owns the exact block field shapes; the tool rejects
+unknown or missing fields by name, and `workflow(action="validate")` reports
+each field error with its path. This guide covers semantics and constraints
+only — compose blocks against the schema, not against prose.
 
 `objective` is required and is injected into every generated node. Use blocks
 or nodes, never both. Block IDs use letters, numbers, underscores, and hyphens.
@@ -51,7 +46,8 @@ or existing durable node IDs during **extend** and replan.
 ## Block contracts
 
 - `explore`: read-only repository mapping and evidence collection.
-- `plan`: implementation-ready decomposition, seams, checks, and risks.
+- `plan`: decision- or implementation-ready options/work packages, checks,
+  falsifiers, and risks.
 - `prototype`: the smallest throwaway experiment that resolves a runnable
   uncertainty; it does not silently become production code. It still publishes
   its changed-file list and fingerprint so later verification or review cannot
@@ -65,6 +61,10 @@ or existing durable node IDs during **extend** and replan.
   fingerprint through both reviews into an `ACCEPT | REJECT` decision.
 - `synthesize`: resolves dependency outputs into the parent-facing result.
 
+Block contracts are self-contained. `instruction` specializes a lifecycle kind
+into a capability such as `codebase-design`, `domain-modeling`, or
+`global-review`; it never delegates the method to an external Skill.
+
 Judgment and acceptance gates (`plan`, debug diagnosis, `verify`, review
 decision, and `synthesize`) are required by default. Volume lanes (`explore`,
 `prototype`, `coding`, debug evidence, and independent review lanes) are
@@ -74,41 +74,10 @@ stay quiet. A block immediately after a review gate is conditioned on its
 accepted verdict. Because the condition language handles one verdict reference,
 fan multiple review lanes into one review block before continuing.
 
-## Composition routes
-
-Choose only blocks justified by current evidence:
-
-- Product or architecture decision: parallel `explore` lanes → `plan` options
-  → `review` or `synthesize`.
-- Project feature: optional parallel `explore` or proposal lanes → `plan` →
-  ordered `coding`/assembly → `verify` → `review`.
-- Hard bug: `debug` → `coding` → `verify` → `review`.
-- Runnable design uncertainty: `prototype` → `plan`; keep the prototype
-  disposable unless the confirmed scope explicitly promotes it.
-- Existing implementation review: `explore` scope lanes → `review`; add a
-  separate verification block first when test evidence is required.
-
-Do not add a phase merely because it exists. Skip exploration when repository
-facts are already known and skip a prototype when ordinary inspection resolves
-the question. All block workers share one workspace: the compiler serializes
-otherwise-unordered `coding` and `prototype` writers, while read-only discovery
-and proposal lanes remain parallel. Use `synthesize` only when multiple outputs
-need reconciliation.
-
-## Parent decision checkpoint
-
-User qualification is not a DAG block. Before executable blocks start, the
-parent gathers facts it can discover, creates recommended answers for every
-material open decision, displays one compact decision brief, and asks for one
-combined confirmation. The brief contains the recommended route, alternatives
-only where they change the result, assumptions, risks, scope, and acceptance
-evidence. A correction from the user updates the brief; unchanged confirmed
-facts are not asked again.
-
-After confirmation, encode the decision in `objective` and block instructions.
-If the request is already fully bounded and confirmed, do not manufacture a
-redundant checkpoint. Child nodes never ask the user to make product or scope
-decisions.
+All block workers share one workspace. The compiler serializes
+otherwise-unordered `coding` and `prototype` writers, while read-only lanes may
+remain parallel. The resident Orchestration Router owns route selection and
+phase pruning; this guide owns block fields, contracts, and graph mechanics.
 
 ## When to use low-level nodes