sync: from iop v1.1.172

agent-ops/.version

@@ -1 +1 @@
-1.1.171
+1.1.172

agent-ops/skills/common/_templates/implementation-user-review-request-section.md

@@ -1,12 +1,5 @@
 ## 사용자 리뷰 요청
 
-_선택된 Milestone `구현 잠금 > 결정 필요`가 구현을 막을 때만 채운다. 이 섹션을 포함한 모든 구현 소유 섹션을 채운 뒤 `review-ready`를 보고하고 종료한다. code-review를 실행하거나 review model을 시작하지 않는다._
+> 기본값은 `없음`이다. 선택된 Milestone `구현 잠금 > 결정 필요`가 구현을 막을 때만 `없음`을 `사유 유형: milestone-lock`, `연결 대상`, `결정 필요`, `차단 근거`, `실행한 검증/명령`, `재개 조건`으로 교체한다.
 
-- 상태: 없음
+없음
-- 사유 유형: 없음
-- 연결 대상: 없음
-- 결정 필요: 없음
-- 차단 근거: 없음
-- 실행한 검증/명령: 없음
-- 후속으로 해결할 수 없는 이유: 없음
-- 재개 조건: 없음

agent-ops/skills/common/code-review/SKILL.md

@@ -52,7 +52,7 @@ Finalization recovery uses the durable artifact combination itself: verdict-appe
 
 - Derive the pending review archive suffix as `0` when no `code_review_*.log` exists, otherwise `max(existing numeric suffix) + 1`; set `review-number` to that suffix plus one.
 - Repeated `WARN`/`FAIL`, missing verification evidence, and environment blockers do not trigger `USER_REVIEW.md`; record them as findings for the next plan model.
-- If the active review file has a filled `사용자 리뷰 요청` with `상태` other than `없음`, validate that `사유 유형` is `milestone-lock`, that `연결 대상` points to the selected Milestone, and that the requested decision matches a Milestone `구현 잠금 > 결정 필요` item.
+- If the active review file's `사용자 리뷰 요청` body is not exactly `없음`, require `사유 유형: milestone-lock`, `연결 대상`, `결정 필요`, `차단 근거`, `실행한 검증/명령`, and `재개 조건`. Validate that the target is the selected Milestone and the requested decision matches its `구현 잠금 > 결정 필요` item.
 - A valid Milestone-lock request is `Required`/`FAIL` and writes `USER_REVIEW.md` instead of a follow-up pair.
 - If the request is not tied to the Milestone lock, do not write `USER_REVIEW.md`; record it as a WARN/FAIL finding.
 - `USER_REVIEW.md` is created from `agent-ops/skills/common/code-review/templates/user-review-template.md`, filled with the archived loop history, current archived plan/review paths, verdict, loop count, blocking evidence, connection target, and the exact Milestone decision item.
@@ -202,7 +202,7 @@ Before writing the verdict:
 - Record obvious non-behavioral source nits such as typos, stale comments, docs, or formatting. Do not edit source/test files during review; Nit-only findings may follow the PASS rule below.
 - If a checklist item contains integrated verification for a feature, treat that feature item as incomplete until both implementation evidence and the matching verification output are present. Do not accept a separate unchecked completion-criteria item as a substitute.
 - Confirm the implementation marked the matching checklist items in the active review file, including the final mandatory `CODE_REVIEW-*-G??.md` completion item. Do not mark or rewrite implementation-owned items on its behalf; classify missing or inconsistent entries by their effect on completeness and verification trust.
-- Verify that the PLAN `plan-model` metadata (or the legacy `역할 모델 > Plan` field) matches the review ledger and that the review stub records the Implementation identity. Require runtime to record the Review identity before verdict; filled identities are immutable. Reject review start unless all three are pairwise different, and do not infer identity from lane/G or agent name.
+- Verify that the PLAN `plan-model` metadata (or legacy `역할 모델 > Plan`) matches the review file's `plan-model` metadata or legacy ledger. Require non-`pending` `implementation-model` and `review-model` metadata before verdict; legacy visible identity fields remain readable for existing pairs. Filled identities are immutable. Reject review start unless all three are pairwise different, and do not infer identity from lane/G or agent name.
 - If the active plan or review file contains `Agent UI Completion`, verify the implementation-owned fields are filled before PASS: listed agent-ui docs exist, actual code evidence paths exist, requested status updates are explicit, and implementation verification evidence is present. Missing or untrusted evidence is a completeness or verification-trust issue.
 - Treat review artifact gaps as failures only when they prevent judging implementation correctness, tests, contracts, or verification trust.
 - Read `사용자 리뷰 요청`. If filled, validate the exact linked Milestone decision and blocker evidence; reject non-lock requests.

agent-ops/skills/common/plan/SKILL.md

@@ -362,6 +362,8 @@ Replace every occurrence of each token below:
 - Generated row/section tokens: `{implementation_completion_rows}` contains one row for every plan item, and `{verification_result_sections}` contains the fixed verification instructions plus every intermediate/final command from the plan.
 - `{implementation_user_review_request_section}` is replaced by the full contents of `agent-ops/skills/common/_templates/implementation-user-review-request-section.md`; do not prepend another `사용자 리뷰 요청` heading.
 
+The rendered review file stores Plan/Implementation/Review identities only in top metadata comments. Runtime replaces each `pending` value before that role starts; the Worker never edits those comments.
+
 `{review_checkpoints}` contains only product behavior, scope, contract, and verification focuses useful while implementing. Do not include model identity, dependency/`complete.log`, archive, terminal-output, or finalization checks; the Review skill owns those controls.
 
 Use the routed build/review grades independently. Remove optional plan-copy content by replacing its token with an empty string, not by leaving template instructions.
@@ -396,5 +398,5 @@ After every pair is promoted, resolve only its encoded predecessor `complete.log
 - The plan model wrote the routed pair, reported `implementation-ready` or `dependency-waiting` from dependency evidence, and stopped without implementing, reviewing, or starting another agent.
 - An explicitly replaced unstarted pair was archived only after its replacement pair was fully staged, with distinct monotonic log suffixes.
 - Follow-up routing does not inherit prior lane/G, and implementation/user-review ownership remains unchanged.
-- Every generated review ledger states the three-model separation, and the PLAN worker rules state the one-role-per-invocation boundary.
+- Every generated review file stores the three model identities only in metadata comments, and the PLAN worker rules state the one-role-per-invocation boundary.
-- The PLAN metadata comment and review ledger contain the same runtime-provided Plan model identity; Implementation and Review identities remain pending until runtime starts those roles.
+- The PLAN and review `plan-model` comments contain the same runtime-provided identity; `implementation-model` and `review-model` remain `pending` until runtime starts those roles.

agent-ops/skills/common/plan/templates/review-stub-template.md

@@ -1,11 +1,14 @@
 <!-- task={task_name} plan={plan_number} tag={TAG} -->
+<!-- plan-model={plan_model_identity} -->
+<!-- implementation-model=pending -->
+<!-- review-model=pending -->
 
 # Code Review Reference - {TAG}
 
 > **[IMPLEMENTATION WORKER]**
 > Complete the implementation checklist, fill the implementation evidence below, report `review-ready`, and stop.
 > Edit only completion checkboxes, `계획 대비 변경 사항`, `주요 설계 결정`, `사용자 리뷰 요청`, Agent UI implementation evidence when present, and command output blocks.
-> Do not edit role identities, review, archive, create terminal files, or start another agent. Runtime and the later Review model own those actions.
+> Do not edit metadata comments or fixed sections, review, archive, create terminal files, or start another agent. Runtime and the later Review model own those actions.
 > Do not ask the user directly. Use `사용자 리뷰 요청` only for a selected Milestone `구현 잠금 > 결정 필요`; record other blockers in the implementation evidence.
 
 ## 개요
@@ -13,14 +16,6 @@
 date={date}
 task={task_name}, plan={plan_number}, tag={TAG}
 
-## 역할 모델
-
-- Plan: `{plan_model_identity}`
-- Implementation: `pending`
-- Review: `pending`
-
-> Runtime-only ledger. Runtime requires three distinct model identities; the implementation worker does not edit it.
-
 {roadmap_targets_or_omit}
 {archive_evidence_snapshot_or_omit}
 

agent-ops/skills/common/refine-local-plans/SKILL.md

@@ -42,7 +42,7 @@ description: 현재 plan들 세분화해, 현재 plan 세분화, 기존 plan 더
 
 4. **현재 Worker 형식으로 pair를 만든다**
    - Build/review lane과 G는 원본을 유지하고 재라우팅하지 않는다.
-   - 현재 runtime-provided Plan model identity를 PLAN metadata와 review ledger에 동일하게 기록한다. Implementation/Review는 `pending`으로 둔다.
+   - 현재 runtime-provided Plan model identity를 PLAN과 review의 `plan-model` metadata에 동일하게 기록한다. Review에는 `implementation-model=pending`, `review-model=pending` metadata만 두고 가시적인 역할 섹션은 만들지 않는다.
    - PLAN은 `구현 에이전트 규칙` 네 bullet, 짧은 `배경`, 실행에 필요한 `구현 범위`, checklist, 항목, 수정 파일, 검증만 둔다. 원본에 `Archive Evidence Snapshot`이 있으면 구현에 필요한 finding과 affected path만 담당 child에 보존한다.
    - 분석 파일 목록, routing 점수, 분할 과정, dependency 상태/경로와 전체 archive history를 Worker PLAN에 쓰지 않는다.
    - CODE_REVIEW는 `agent-ops/skills/common/plan/templates/review-stub-template.md`의 compact Worker 구조를 사용한다. Product behavior/scope/contract/verification checkpoint만 넣고 dependency, `complete.log`, archive, finalization, review 전용 checklist는 넣지 않는다.

agent-ops/skills/common/router.md

@@ -51,7 +51,7 @@ Plan/review 역할 경계:
 - PLAN/CODE_REVIEW 작성 또는 재작성이 요청 범위에 포함되면 `plan`을 선택한다. `plan`이 최종 단계에서 `finalize-task-routing`을 필수 호출한다.
 - lane/G/canonical filename 판단만 요청되고 plan 문서 작성은 요청되지 않았을 때만 `finalize-task-routing`을 직접 선택한다.
 - plan, implementation, review는 서로 다른 모델이 한 역할씩 수행한다. 현재/root 모델은 다음 역할을 다른 모델에 맡길 수 있지만 직접 그 역할을 수행하지 않는다.
-- Runtime은 선택 task path와 역할별 model identity를 pair/handoff에 기록한다. 다음 역할 시작 전에 identity 중복을 거부하고 encoded predecessor를 다시 확인한다. 구현 소유 리뷰 섹션이 모두 채워지고 dependency가 충족된 `review-ready` 상태에서만 Review 모델을 시작한다.
+- Runtime은 선택 task path와 역할별 model identity를 pair/handoff의 metadata comment에 기록한다. 다음 역할 시작 전에 identity 중복을 거부하고 encoded predecessor를 다시 확인한다. 구현 소유 리뷰 섹션이 모두 채워지고 dependency가 충족된 `review-ready` 상태에서만 Review 모델을 시작한다.
 - Indexed task의 basename은 `NN_{subtask_name}` 또는 `NN+PP[,QQ...]_{subtask_name}`이어야 하고 모든 predecessor는 `NN`보다 작아야 한다. Runtime은 malformed 이름을 implementation에 전달하지 않고 Plan 이관 대상으로 돌린다. 유효한 `_`/`+PP[,QQ...]` dependency는 runtime이 해석하며, 모든 predecessor의 matching `complete.log`가 확인된 pair만 implementation에 전달한다. Worker에게 archive 검색이나 dependency 판정을 맡기지 않는다.
 - Plan은 PLAN/CODE_REVIEW pair 작성과 `implementation-ready`/`dependency-waiting` 판정, implementation은 리뷰 문서 완성, review는 후속 plan pair·`USER_REVIEW.md`·`complete.log` 중 하나를 남긴 뒤 끝난다.
 - WARN/FAIL 리뷰는 다른 Plan 모델이 후속 pair를 작성한 뒤 끝나며, 같은 리뷰 흐름에서 구현하지 않는다.