[01/36] Add OpenCollection agent plan

[cjohnsto-nz]

Scope and stack-integrity note

This PR remains the OpenCollection agent-plan foundation. Review-only dependency and ownership clarifications were initially added here in 78e7526, but the 37-PR sequential composition audit proved that retaining them on the base branch creates a conflict at PR #46.

Those seven clarifications are preserved at the stack tip in PR #72 as d6b3799. Commit 8b815fd removes them from this historical branch, leaving this PR's implementation diff in its original scope.

Validation:

• PR [01/36] Add OpenCollection agent plan #35 -> PR [02/36] Add OC-000 protocol dispatch foundation #36 three-way simulation: clean
• all 37 live branch heads compose sequentially without conflicts
• GitHub: MERGEABLE / CLEAN --- This is **part 21 of 21 in a stack** made with GitButler: -  21  [22/36] Release 0.8.0 with packaged PDF.js preview #54 -  20  [21/36] Complete OC-070 protocol surface polish #56 -  19  [20/36] Record final OpenCollection supervisor acceptance #53 -  18  [19/36] Add OC-110 runtime authoring UX #52 -  17  [18/36] Add OC-080 runtime lifecycle and OC-110 task setup #51 -  16  [16/36] Record OC-050 OC-090 OC-100 supervisor audit #50 -  15  [15/36] Add OC-050 auth and transport support #49 -  14  [14/36] Add OC-100 request type UX #48 -  13  [13/36] Add OC-100 request type UX task #47 -  12  [12/36] Add OC-080 and OC-090 task tracks #46 -  11  [11/36] Record OC-010 through OC-040 supervisor audit #45 -  10  [10/36] Add OC-020 WebSocket support #44 -  9  [09/36] Add OC-010 GraphQL support #43 -  8  [08/36] Require demo server fixtures for parallel tracks #42 -  7  [07/36] Record OC-000 and OC-060 supervisor audit #41 -  6  [06/36] Add OC-060 schema round-trip validation #40 -  5  [05/36] Add OC-040 runtime scripting support #39 -  4  [04/36] Add OC-090 gRPC streaming support #38 -  3  [03/36] Add OC-030 gRPC unary protobuf support #37 -  2  [02/36] Add OC-000 protocol dispatch foundation #36 -  1  [01/36] Add OpenCollection agent plan #35 <-- current

[APKiwi]

Reviewed the whole stack, leaving findings per PR. This one covers the plan doc.

Verdict: approve with nits. The plan's factual claims spot-checked against main all held up (Item union, HttpClient.send, HttpRequest-only validation, OAuth2 always-bearer/always-S256, missing redirect/proxy/mTLS). Sequencing is coherent. Issues:

• No dependency budget anywhere in the plan. tasks/03-grpc.md:33 prescribes @grpc/grpc-js + @grpc/proto-loader with no mention of transitive weight, and none of the task files or skills tell implementers to minimize deps. The gRPC libs themselves are the right call (reimplementing protobuf/HTTP2 is not on the table). But this doc is the first thing every implementer reads, so it should carry the rule explicitly: prefer zero/low new deps, get sign-off before adding anything with a non-trivial transitive tree. The unused ws dep landing in the gRPC PR downstream is exactly what this rule would have caught.
• tasks/04-runtime-scripting-testing.md:36-37 presents Node's vm as a viable sandbox option for untrusted scripts. Node's own docs say vm is not a security mechanism and must not run untrusted code. The table frames vm vs isolated-vm as a lightness tradeoff, which contradicts the task's own "treat scripts as untrusted collection content" line. Should say: never bare vm for untrusted scripts, prefer a restricted worker or accept the isolation cost.
• 61% of the diff (1687 of 2768 lines) is a vendored GitButler CLI skill bundle (.opencode/skills/gitbutler/*) with zero OpenCollection content, inside a PR titled "Add OpenCollection agent plan". Easy to miss what actually landed here.
• Minor: "Postman script conversion" is listed as a current gap (tasks/04:19) but no task owns it. OC-040's implementation plan never mentions it and OC-070 assumes OC-040 handled it. It will fall through the cracks.
• Minor: OC-000's scope lists tree/CodeLens/editor touchpoints that overlap the editor-schema skill's stated domain, but the goal prompts assign OC-000 solely to the protocol implementer. Two parallel agents could both touch codeLensProvider.ts with no clear owner.
• Minor: README.md:34 records C:\Users\chris\.agents\skills\gitbutler as verified evidence. A personal machine path is not reproducible for anyone else reading this as setup guidance.
• Nit: title says part 1 of 36, the stack footer lists 21 parts.

Deps: none added by this PR itself. See the budget point above for what the plan should require of the implementation PRs.

[cjohnsto-nz]

@APKiwi Addressed comment feedback.
Made changes appropriate, given that this is the base of a stacked PR and the plan has already been consumed by the downstream agents, some of them are moot, but will inform future tasks using this ledger.

• Added dependency-budget guidance for downstream implementation work.
• Updated OC-040 to explicitly prohibit bare Node vm for untrusted collection scripts.
• Clarified that OC-070 owns Postman script/event conversion, while OC-040 owns the runtime contract.
• Checked downstream OC-070 (feature/oc-070-surface-polish, PR [21/36] Complete OC-070 protocol surface polish #56): Postman collection, folder, and request event mapping is implemented and covered by test/oc070SurfacePolish.test.ts and the Postman importer tests.
• Clarified OC-000 versus protocol/OC-070 ownership for tree, CodeLens, commands, imports, and exports.
• Replaced the personal GitButler path with %USERPROFILE%.

I left the GitButler bundle and stack-footer mismatch unchanged because those are intentional/generated stack metadata concerns rather than plan-content defects.

[cjohnsto-nz]

Stack-integrity correction after the full sequential audit:

I moved the review-only dependency and ownership clarifications from 78e7526 to the stack-tip rework PR #72 as d6b3799. Commit 8b815fd removes them from this historical branch, so the feedback is preserved without carrying the PR #46 conflict through the stack.

Verified final state:

• PR [01/36] Add OpenCollection agent plan #35 -> PR [02/36] Add OC-000 protocol dispatch foundation #36 is clean
• all 37 live PR heads compose sequentially without conflicts
• GitHub reports this PR MERGEABLE / CLEAN and all checks pass