feat(dag): tiered dag.jsonc defaults, pause-first replan protocol, domain playbooks

.gitignore

@@ -28,6 +28,7 @@ target
 
 # Local dev files
 opencode-dev
+packages/opencode/script/config.json
 UPCOMING_CHANGELOG.md
 logs/
 *.bun-build
@@ -46,4 +47,5 @@ tsconfig.tsbuildinfo
 .agents
 .claude
 .opencode/commands/
-.opencode/skills
+.opencode/skills
+.qoder

packages/core/src/plugin/command.ts

@@ -10,11 +10,13 @@ import PROMPT_REVIEW from "./command/review.txt"
 import DAG_FLOW_PROMPT from "./command/dag-flow.txt"
 import workflowContent from "./command/workflow.md" with { type: "text" }
 import orchestrationPolicy from "./command/orchestration-policy.md" with { type: "text" }
+import orchestrationDomains from "./command/orchestration-domains.md" with { type: "text" }
 
 export const DagFlowDescription = "Start a dependency-graph multi-agent workflow for the supplied task"
 export const WorkflowFactsContent = workflowContent
 export const OrchestrationPolicyContent = orchestrationPolicy
-export const WorkflowContent = `${WorkflowFactsContent}\n\n${OrchestrationPolicyContent}`
+export const OrchestrationDomainsContent = orchestrationDomains
+export const WorkflowContent = `${WorkflowFactsContent}\n\n${OrchestrationPolicyContent}\n\n${OrchestrationDomainsContent}`
 export const DagFlowContent = `${DAG_FLOW_PROMPT}\n\n${WorkflowContent}`
 
 export const Plugin = define({

packages/core/src/plugin/command/orchestration-domains.md

@@ -0,0 +1,116 @@
+# Orchestration Domains
+
+Productized workflow playbooks for recurring heavy-task domains. Each playbook
+composes the existing primitives — profiles, review lifecycle, actionable
+checkpoints, bounded repair, and the pause-first replan protocol — into a
+repeatable graph shape. Resolve every role below as a capability slot per Role
+Resolution: prefer a configured agent whose contract matches (an explore-style
+scout, a reasoner-style logic prober, a review-style verdict gate, a
+verify-style test runner), fall back to `explore`, `build`, or `general`.
+
+## The Simulated Audit Loop
+
+Iteration in a DAG is NOT a cyclic edge and NOT a harness loop. It is a
+verdict-driven replan wave:
+
+1. An audit node declares `output_schema` with a normalized `verdict` and
+   `report_to_parent: true`.
+2. On `REJECT` or `REVISE`, the wake delivers findings to the parent. The
+   parent issues `control(pause)`, then `control(replan)` appending a
+   correction node and a NEW audit node under NEW ids (terminal nodes are
+   immutable), wires `depends_on` forward, then `control(resume)`.
+3. Repeat until the audit returns `ACCEPT`. The loop is bounded by
+   `max_node_replan_attempts` and `max_total_nodes` — on ceiling breach stop
+   with `BLOCKED` and report the residual findings instead of retrying the
+   identical plan.
+
+Every playbook below that says "audit loop" means exactly this mechanism.
+
+## Playbook: Deep Review
+
+Multi-role adversarial review of whether a code structure or design is sound.
+
+- Fan out 3+ reviewers with genuinely conflicting mandates: a prosecutor
+  (argues the structure is wrong — coupling, hidden invariants, failure
+  modes), a defender (argues the current shape is justified — constraints,
+  history, cost of change), and dimension specialists (architecture,
+  correctness, testability) as scope demands.
+- Fan in to one arbiter that must resolve prosecutor/defender conflicts
+  finding-by-finding, not merely concatenate them, and emit the actionable
+  checkpoint shape (`verdict`, `findings`, `required_actions`, `next_action`).
+- Pre-implementation structure reviews are `design` phase. Reviewing an actual
+  change requires the diff-phase hard contract:
+  `implementation → verification(PASS) → diff review` with fingerprint echo.
+- On `REVISE`/`REJECT`, drive corrections through the audit loop.
+
+## Playbook: Deep Speculation
+
+Prophesy a whole design document — stress-test it end to end and emit an
+automated verdict with zero human gates in the middle.
+
+- Internalized grill method, run as graph roles instead of user Q&A: parallel
+  nodes over the same document — a logic simulator (walk the described system,
+  surface contradictions and boundary gaps), an adversarial interrogator
+  (produce the hardest material questions: hidden assumptions, falsifiers,
+  failure modes, evidence quality), and an alternatives prober (steelman one
+  competing shape).
+- A responder node answers the interrogation strictly from the document plus
+  codebase evidence, marking each question ANSWERED / GAP / CONTRADICTION.
+- An arbiter synthesizes everything into a structured prophecy: verdict,
+  ranked risks, unresolved gaps, and a concrete revision list — then the audit
+  loop applies revisions and re-speculates until ACCEPT.
+- Fully automated: no admission QA rounds with the user mid-flight. Reserve
+  interactive `GRILL` admission for before the workflow starts.
+
+## Playbook: Large Engineering
+
+Turn an execution document (todo list, work ledger, or spec) into audited,
+parallel-safe delivery.
+
+1. **Deep analysis** — scout nodes map the affected surface; an analyst node
+   decomposes the document into work packages with explicit dependency edges
+   and disjoint write sets (the tickets: each package states its blocking
+   edges, not a bare list).
+2. **Orchestrate** — compile the packages into a graph: independent packages
+   fan out in parallel, dependent ones serialize, propose-then-assemble where
+   write sets may overlap.
+3. **Audit the plan** — a plan-audit node checks the decomposition itself:
+   missing edges, false parallelism, unstated assumptions, acceptance criteria
+   per package. `REJECT` re-orchestrates via the audit loop until the plan
+   passes.
+4. **Execute** — run the audited graph with the develop-profile phases each
+   package still needs; verification consumes each implementation before any
+   diff review.
+5. **Final adversarial review** — the Deep Review playbook over the assembled
+   result, with its own audit loop.
+6. **Deliverable** — a final assembler emits the outcome report: shipped
+   packages, evidence, residual risks.
+
+## Playbook: Solution Bake-off
+
+N competing approaches implemented or prototyped in parallel against the same
+acceptance criteria; a verify-style node exercises each candidate; one arbiter
+picks the winner on evidence and records why the losers lost.
+
+## Playbook: Root-Cause Diagnosis
+
+Fan out one node per plausible hypothesis, each tasked to falsify its own
+hypothesis with concrete evidence; an arbiter eliminates, ranks survivors, and
+either declares the root cause or replans a deeper probe wave on the leading
+survivor.
+
+## Playbook: Audit Sweeps
+
+The same fan-out/arbiter/audit-loop shape covers recurring sweep domains:
+security surface audit (per-surface reviewers: input handling, authz, secrets,
+dependencies), regression matrix fan-out (one verify node per axis cell), and
+docs-code drift audit (per-document checkers comparing claims against the
+code, with fix waves through the audit loop).
+
+## Choosing and Combining
+
+Playbooks compose: Large Engineering embeds Deep Review at its gate; Deep
+Speculation can front-load any of them. Selection still obeys Execution Mode
+Selection — a playbook is justified only when the task shows both a scenario
+and a structural signal, and explicit user constraints always override the
+playbook shape.

packages/core/src/plugin/command/orchestration-policy.md

@@ -190,3 +190,14 @@ Do not poll `status` merely to wait. Atomic wake reports actionable checkpoints
 Implement review-and-repair with finite `extend` or `control(replan)` operations. Target only the nodes and findings that require repair. You MUST NOT create cyclic `depends_on`, predeclare unbounded speculative repair waves, or start an unrelated replacement workflow.
 
 Declare a finite `max_node_replan_attempts`. When the ceiling is exhausted, stop with `BLOCKED`, report the remaining findings, and do not retry the identical plan.
+
+## Replan Protocol (pause-first)
+
+A replan fragment takes real time to compose — template rendering, model reasoning, node rewiring. While you compose it, the workflow keeps scheduling and can reach a terminal status, after which replan is rejected (terminal workflows are immutable). Freeze first, then think:
+
+1. On any user cancel/replan/model-change intent, IMMEDIATELY issue `control(pause)` in the same turn. Pause needs no fragment, applies in milliseconds, and stops new node spawns.
+2. Pause does not interrupt nodes that are already running. Decide their disposition inside the fragment: `restart: true` re-spawns a running node with the new definition (its in-flight child session is hard-aborted at re-spawn), `cancel: true` terminates it, absence keeps it running to completion.
+3. Compose the fragment, then issue `control(replan)` — replan is valid while paused.
+4. Issue `control(resume)` to restore scheduling.
+
+If the workflow terminalized before you paused, do not force the replan: start a new workflow carrying the updated definitions, and state which prior results are superseded.

packages/core/src/plugin/command/workflow.md

@@ -474,7 +474,7 @@ Workflows are not static. After creating a workflow, use `extend` and `control(r
 
 - **Scale up**: a node reports the work is larger than expected → `extend` with additional parallel nodes to split the load.
 - **Cut short**: a node proves the remaining work is unnecessary → `control(complete)` to early-complete and skip pending nodes.
-- **Redirect**: a gate or review reveals a wrong direction → `control(replan)` with `restart: true` on the affected nodes and `cancel: true` on their downstream dependents.
+- **Redirect**: a gate or review reveals a wrong direction → `control(pause)` first to freeze scheduling, then `control(replan)` with `restart: true` on the affected nodes and `cancel: true` on their downstream dependents, then `control(resume)`.
 
 Only nodes with `report_to_parent: true` produce intermediate parent
 checkpoints, and those reports are delivered at the next actionable wake
@@ -583,10 +583,10 @@ checkpoint naturally completed the current graph; an early
 **status** — Read the durable state of one workflow and all of its nodes. Pass `workflow_id`. Use it when the user explicitly asks for current state or once before a decision that requires fresh state, such as replan/control. Do not poll a running workflow merely to wait: node reports and terminal outcomes wake the parent session automatically.
 
 **control** — Control a running workflow:
-- `pause` — let running nodes finish, don't spawn new ones (pause does NOT stop nodes that are already running)
+- `pause` — let running nodes finish, don't spawn new ones (pause does NOT stop nodes that are already running). On a cancel/replan intent, always pause FIRST: it needs no fragment and freezes scheduling while you compose the replan, so the graph cannot terminalize under you.
 - `resume` — resume scheduling
 - `cancel` — cancel the entire workflow
-- `replan` — submit a YAML fragment; running nodes can be `restart: true` or `cancel: true`; pending nodes absent from the fragment are cancelled
+- `replan` — submit a YAML fragment; running nodes can be `restart: true` or `cancel: true`; pending nodes absent from the fragment are cancelled. Valid while paused — the pause → compose fragment → replan → resume sequence is the safe path.
 - `complete` — early-complete: remaining pending nodes are skipped (non-violation)
 - `step` — advance exactly one ready node (the first by node ID lexicographic order), then wait. Use for controlled debugging or staged verification of a critical path. Unlike `pause`, which freezes all scheduling, `step` advances one node and re-waits. A second `step` while the stepped node is still running is rejected. Use `resume` to return to full-speed scheduling. Nodes are selected in lexicographic ID order for determinism.
 

packages/core/test/plugin/command.test.ts

@@ -132,6 +132,39 @@ describe("CommandPlugin.Plugin", () => {
     }),
   )
 
+  it.effect("defines the pause-first replan protocol", () =>
+    Effect.sync(() => {
+      expect(CommandPlugin.OrchestrationPolicyContent).toContain("## Replan Protocol (pause-first)")
+      expect(CommandPlugin.OrchestrationPolicyContent).toContain("IMMEDIATELY issue `control(pause)`")
+      expect(CommandPlugin.OrchestrationPolicyContent).toContain("replan is valid while paused")
+      expect(CommandPlugin.OrchestrationPolicyContent).toContain("Pause does not interrupt nodes that are already running")
+      expect(CommandPlugin.WorkflowFactsContent).toContain("always pause FIRST")
+    }),
+  )
+
+  it.effect("defines productized orchestration domain playbooks", () =>
+    Effect.sync(() => {
+      expect(CommandPlugin.WorkflowContent).toContain("# Orchestration Domains")
+      expect(CommandPlugin.OrchestrationDomainsContent).toContain("## The Simulated Audit Loop")
+      expect(CommandPlugin.OrchestrationDomainsContent).toContain("NOT a cyclic edge and NOT a harness loop")
+      expect(CommandPlugin.OrchestrationDomainsContent).toContain("NEW ids (terminal nodes are")
+      for (const playbook of [
+        "## Playbook: Deep Review",
+        "## Playbook: Deep Speculation",
+        "## Playbook: Large Engineering",
+        "## Playbook: Solution Bake-off",
+        "## Playbook: Root-Cause Diagnosis",
+        "## Playbook: Audit Sweeps",
+      ]) {
+        expect(CommandPlugin.OrchestrationDomainsContent).toContain(playbook)
+      }
+      expect(CommandPlugin.OrchestrationDomainsContent).toContain("prosecutor")
+      expect(CommandPlugin.OrchestrationDomainsContent).toContain("zero human gates in the middle")
+      expect(CommandPlugin.OrchestrationDomainsContent).toContain("max_node_replan_attempts")
+      expect(CommandPlugin.OrchestrationDomainsContent).toContain("capability slot per Role")
+    }),
+  )
+
   it.effect("defines parent-session admission fixtures for standard deep and GRILL requests", () =>
     Effect.sync(() => {
       const fixtures = [