release: promote workflow, memory, goal, and DAG fixes

.github/actions/setup-bun/action.yml

@@ -56,9 +56,9 @@ runs:
         # e.g. ./patches/ for standard-openapi
         # https://github.com/oven-sh/bun/issues/28147
         if [ "$RUNNER_OS" = "Windows" ]; then
-          bun install --linker hoisted ${{ inputs.install-flags }}
+          bun install --frozen-lockfile --linker hoisted ${{ inputs.install-flags }}
         else
-          bun install ${{ inputs.install-flags }}
+          bun install --frozen-lockfile ${{ inputs.install-flags }}
         fi
       shell: bash
 

.github/workflows/release-fork.yml

@@ -89,31 +89,40 @@ jobs:
   # (LeXwDeX/opencode-dag-config) into a release asset. dev/main do not manage
   # these templates anymore — the config repo is the single source of truth.
   # Read-only: no commits, no pushes, so branch protection never blocks it.
+  #
+  # Validate-before-package: the releasing runtime commit runs its directory
+  # validator against the config repo HEAD BEFORE any copy/package step. Any
+  # invalid template — or an unavailable validator — fails the job (fail
+  # closed), so an unchecked archive can never be uploaded or embedded.
   package-templates:
     name: Package Reference Templates
     if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
+      - name: Checkout Runtime (releasing commit)
+        uses: actions/checkout@v4
+
       - name: Clone Config Repo
         uses: actions/checkout@v4
         with:
           repository: LeXwDeX/opencode-dag-config
           path: dag-config
 
-      - name: Package Templates
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+        with:
+          save-cache: false
+
+      - name: Install Runtime Dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Validate and Package Templates (fail closed)
+        working-directory: packages/opencode
         run: |
-          mkdir -p dist
-          shopt -s nullglob
-          files=(dag-config/*.yaml)
-          if [ ${#files[@]} -gt 0 ]; then
-            cp "${files[@]}" dist/
-          else
-            echo "::warning::No templates found in opencode-dag-config root; packaging empty archive"
-          fi
-          tar -czf dag-templates.tar.gz -C dist .
-          echo "Templates packaged: $(ls dist | wc -l) files"
+          echo "Packaging config commit $(git -C "$GITHUB_WORKSPACE/dag-config" rev-parse HEAD) with runtime commit $(git rev-parse HEAD)"
+          bun run script/package-dag-templates.ts "$GITHUB_WORKSPACE/dag-config" "$GITHUB_WORKSPACE/dag-templates.tar.gz"
 
       - name: Upload Templates Artifact
         uses: actions/upload-artifact@v4
@@ -224,15 +233,9 @@ jobs:
           for dir in opencode-*/; do
             base="${dir%/}"
             if [[ "$base" == *linux* ]]; then
-              tar -czf "${base}.tar.gz" -C "${base}/bin" .
+              bun run ../script/package-cli-artifact.ts "$base" "${base}.tar.gz"
             else
-              cd "${base}/bin"
-              if command -v zip &>/dev/null; then
-                zip -r "../../${base}.zip" .
-              else
-                pwsh -Command "Compress-Archive -Path '*' -DestinationPath '../../${base}.zip'" 2>/dev/null || 7z a "../../${base}.zip" . || true
-              fi
-              cd ../..
+              bun run ../script/package-cli-artifact.ts "$base" "${base}.zip"
             fi
           done
 

CONTEXT-MAP.md

@@ -5,7 +5,9 @@ Read the context documents relevant to the code or decision under review. Do not
 | Context | Domain document | Primary areas |
 | --- | --- | --- |
 | Session Runtime and Client Contract | [`CONTEXT.md`](CONTEXT.md) | `packages/opencode/src/session`, `packages/opencode/src/system-context`, `packages/protocol`, `packages/client`, `packages/sdk` |
+| Workflow Orchestration | [`packages/opencode/src/dag/CONTEXT.md`](packages/opencode/src/dag/CONTEXT.md) | `packages/opencode/src/dag`, workflow tool, DAG template validation and packaging |
+| Project Memory | [`packages/opencode/src/memory/CONTEXT.md`](packages/opencode/src/memory/CONTEXT.md) | `packages/opencode/src/memory`, Memory-owned worktree lifecycle integration |
 
 ## Contexts created lazily
 
-DAG orchestration does not yet have a dedicated `CONTEXT.md`. The full DAG review must establish terminology from implementation, tests, existing specifications, and accepted decisions before `/domain-modeling` creates one. Add future contexts to this map only when they have a stable document to reference.
+Add future contexts to this map only when they have a stable document to reference.

NOTICE

@@ -51,3 +51,16 @@ License boundaries
 When a file under an AGPL-covered directory imports MIT-licensed upstream
 modules, the upstream modules remain MIT; only the AGPL-covered files and
 their derivatives carry AGPL obligations.
+
+3. Engineering workflow methodologies
+
+   Source:   https://github.com/mattpocock/skills
+   Revision: 84fdeffd12f2ee307994d1eb6feb48173b6e0502
+   License:  MIT
+   Text:     ./third_party/mattpocock-skills/LICENSE
+   Copyright (c) 2026 Matt Pocock
+
+   Selected decision, evidence, debugging, test-first delivery, codebase
+   design, review, and synthesis methodologies are adapted into product-owned
+   workflow routing and block contracts. Source metadata and adaptation scope
+   are recorded in ./third_party/mattpocock-skills/SOURCE.md.