chore(skill): dogfood deepworkplan pack 7.9.0

.agents/docs/skills_agents_catalog.md

@@ -42,7 +42,7 @@ The full pack lives under [`.agents/skills/dailybot/`](../skills/dailybot/) (rou
 
 ### Deep Work Plan skill pack (vendored from [`DailybotHQ/deepworkplan-skill`](https://github.com/DailybotHQ/deepworkplan-skill))
 
-The full pack lives under [`.agents/skills/deepworkplan/`](../skills/deepworkplan/) (router + 9 sub-skills + addons). Vendored at **v7.8.1** (DWP standard **7.0.0**). The router auto-routes by intent — read [`skills/deepworkplan/SKILL.md`](../skills/deepworkplan/SKILL.md) and let it pick the right sub-skill. Each sub-skill is independently invocable, and each has a short `dwp-*` alias in [`.agents/commands/`](../commands/) for ergonomic typing.
+The full pack lives under [`.agents/skills/deepworkplan/`](../skills/deepworkplan/) (router + 9 sub-skills + addons). Vendored at **v7.9.0** (DWP standard **7.0.0**). The router auto-routes by intent — read [`skills/deepworkplan/SKILL.md`](../skills/deepworkplan/SKILL.md) and let it pick the right sub-skill. Each sub-skill is independently invocable, and each has a short `dwp-*` alias in [`.agents/commands/`](../commands/) for ergonomic typing.
 
 | Slug | Procedure | Use when |
 |------|-----------|----------|
@@ -121,6 +121,6 @@ Persona definitions. Use these as the system prompt / role when spawning a sub-a
 - Don't see a skill that matches? Don't invent one. Do the work directly and tell the user what you did.
 - Don't see a persona that matches? Default to `cli-developer`.
 
-## Dogfood reconciliation — 2026-10-13
+## Dogfood reconciliation — 2026-10-25
 
-DeepWorkPlan v7.8.1, AI Diff Reviewer v3.3.16 and Dailybot skill v3.23.18 are pinned in `skills-lock.json`. The existing addon set still fits. The container is re-rendered with dck v1.0.1 (`dck init --yes`, `dck.toml` unchanged), which embeds coding-agents-kit v1.0.1 and herdr-peers v1.0.0; DeepWorkPlan Vim v1.0.0 remains a container editor layer. The addon registry records agentkit/devcontainer at v1.0.1 and herdr/vim at v1.0.0, so host tools and container embeds now agree. Repository hooks, review rules, design documentation and historical plans are preserved.
+DeepWorkPlan v7.9.0, AI Diff Reviewer v3.3.16 and Dailybot skill v3.23.18 are pinned in `skills-lock.json` (dailybot sits one patch ahead of the pack's v3.23.17 floor). The pack's herdr addon now pins herdr-peers v1.1.0, and the addon registry and the `dev.sh` host install hint follow it. The container is **not** re-rendered: devcontainer-kit stays v1.0.1 and still embeds herdr-peers v1.0.0 (with coding-agents-kit v1.0.1; DeepWorkPlan Vim v1.0.0 remains a container editor layer), so host tools and the container embeds disagree on herdr-peers until dck ships a newer release. The addon registry records agentkit/devcontainer at v1.0.1, herdr at v1.1.0 and vim at v1.0.0. Repository hooks, review rules, design documentation and historical plans are preserved.

.agents/skills/deepworkplan/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: deepworkplan
 description: DeepWorkPlan — turn any repo AI-first and run Deep Work Plans. Routes to create, execute, refine, resume, status, verify, upgrade, and repo-onboarding sub-skills based on intent. Use when the developer wants to plan, execute, manage, or verify structured multi-task work, or make a repository AI-agent-ready.
-version: "7.8.1"
+version: "7.9.0"
 documentation_url: https://deepworkplan.com
 user-invocable: true
 allowed-tools: Bash, Read, Grep, Glob, Edit, Write

.agents/skills/deepworkplan/addons/README.md

@@ -82,8 +82,8 @@ An addon MAY additionally ship per-stack presets, examples, or migration notes.
 | Dailybot integration | [`addons/dailybot/`](dailybot/SKILL.md) | **Authored** — opt-in install of the Dailybot agent skill (**3.23.17**) / CLI (**>= 3.9.0**), auth **deferred** to the Dailybot skill's own consent flow, **four lifecycle events** (kickoff, significant task, blocked, completion) wired as optional best-effort reports via the `report` sub-skill, optional deterministic hook enforcement, and access to the full 17-capability Dailybot skill when invoked directly. The core methodology has **zero** Dailybot dependency. |
 | Dependency upgrade | [`addons/dependency-upgrade/`](dependency-upgrade/SKILL.md) | **Authored** — **near-default**, **package-manager-agnostic** dependency upgrades: offered for every repo with declared dependencies, with the inert `/lib-upgrade` delegator installed under the onboarding consent unless explicitly declined (an install runs no upgrade). When invoked: detect the repo's real manager (npm/pnpm/yarn + ncu, pip/poetry/uv, cargo, go mod, bundler, composer…), classify by semver, upgrade in safe batches, run the repo's **real** validation gate after each batch, revert a failing batch, summarize. |
 | Design system | [`addons/design-system/`](design-system/SKILL.md) | **Authored** — opt-in, **interface-surface-scoped** `DESIGN.md` at `docs/DESIGN.md` (indexed from `AGENTS.md`; root only if no `docs/` tree), covering three profiles in one file: **visual-ui** (design tokens from CSS vars / Tailwind config / token files / component styles; WCAG AA contrast), **cli-output** (semantic terminal styles, output components, TTY/`NO_COLOR` degradation), and **conversational** (voice & register, message anatomy, per-platform rendering with plain-text fallbacks). Reason about the repo's **real** design source — never a brand file — and reconcile an existing `DESIGN.md` instead of clobbering it. Offered by `onboard` **only when an interface surface is detected** — the offer is mandatory, not skippable, with the detection rationale recorded — and every profile (**visual-ui** strongly recommended) installs only after explicit acceptance, never auto-applied. |
-| AI Diff Reviewer | [`addons/ai-diff-reviewer/`](ai-diff-reviewer/SKILL.md) | **Authored** — **required local review** (baseline since 2.3.0): tag-pinned install of the vendored `DailybotHQ/ai-diff-reviewer` skill (currently **v3.3.14**; workflows pin the moving `@v3`; marketplace listing "AI Diff Reviewer") plus a repo-tailored `.review/extension.md`, wired into the Final Review's security pass; the CI Action (Flow B — same prompt bytes as the local pass, methodology and severity parity) and the `apply-review` / `address-review` companions stay an explicit opt-in. |
-| Herdr | [`addons/herdr/SKILL.md`](herdr/SKILL.md) | **Authored** — thin integrator, explicit opt-in offered in `onboard` Phase 7b, pinned to `herdr-peers@v1.0.0` (protocol/interface 1, detected with `herdr-peers --version`; Herdr's official skill pinned `herdrdev/herdr@v0.9.3`): the **interactive** delegation transport of v7 plans — one `herdr-peers ask` to a peer pane on any machine, recorded in the plan journal before it is relied on, the reply asserted until the plan's own gates observe the work. The peer protocol lives in herdr-peers; this folder carries no copy. Never required. |
+| AI Diff Reviewer | [`addons/ai-diff-reviewer/`](ai-diff-reviewer/SKILL.md) | **Authored** — **required local review** (baseline since 2.3.0): tag-pinned install of the vendored `DailybotHQ/ai-diff-reviewer` skill (currently **v3.3.16**; workflows pin the moving `@v3`; marketplace listing "AI Diff Reviewer") plus a repo-tailored `.review/extension.md`, wired into the Final Review's security pass; the CI Action (Flow B — same prompt bytes as the local pass, methodology and severity parity) and the `apply-review` / `address-review` companions stay an explicit opt-in. |
+| Herdr | [`addons/herdr/SKILL.md`](herdr/SKILL.md) | **Authored** — thin integrator, explicit opt-in offered in `onboard` Phase 7b, pinned to `herdr-peers@v1.1.0` (protocol/interface 1, detected with `herdr-peers --version`; Herdr's official skill pinned `herdrdev/herdr@v0.9.3`): the **interactive** delegation transport of v7 plans — one `herdr-peers ask` to a peer pane on any machine, recorded in the plan journal before it is relied on, the reply asserted until the plan's own gates observe the work. The peer protocol and native debate sub-skill live in herdr-peers; this folder carries no copy. Never required. |
 | agentkit | [`addons/agentkit/SKILL.md`](agentkit/SKILL.md) | **Authored** — thin integrator, explicit opt-in offered in `onboard` Phase 7b, pinned to `coding-agents-kit@v1.0.1` (interface 1, detected with `ak doctor --json`): the **headless** delegation transport of v7 plans — one `ak run` per delegate in a dedicated git worktree, recorded through `ledger.py delegate`, result asserted until the plan's own gates observe it. Install by a clone of the exact tag + `install.sh`. The kit launches agents in autonomy by default and its `--ask` / `AGENTKIT_PERMISSIONS=ask` opt-out always wins; the pack spells no autonomy flag and passes only `--ask` — always for a read-only delegate, and for writing delegates when a plan records the opt-out. Never required. |
 | DeepWorkPlan Vim | [`addons/vim/SKILL.md`](vim/SKILL.md) | **Authored** — thin integrator, explicit opt-in offered in `onboard` Phase 7b, pinned to `deepworkplan-vim@v1.0.0` (interface 1, read from the product's `addon/surface.json`). Optional machine-level install of DeepWorkPlan Vim, the terminal editor for Deep Work Plan (Neovim 0.12+, GPL-3.0, its own repo `DailybotHQ/deepworkplan-vim`): detect it through the product's surface, offer — never impose — the editor, guide the documented install (macOS/Linux via the product's install page `https://deepworkplan.com/vim` — download, verify the pinned checksum, run, never a remote-installer pipe spelled in this pack's text; Windows `winget install Neovim.Neovim` + a tagged clone, never piped PowerShell), and validate the installed surface (command index, VS Code gestures, plan browser, markdown viewer). Two routes: the full editor now, the Neovim plugin in v7.1. An existing Neovim config is **never** overwritten without explicit consent — non-interactive installs onto an existing config abort with instructions; backups go to `~/.config/previous-deepworkplan-vim`. Never a conformance gate. |
 

.agents/skills/deepworkplan/addons/agentkit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: deepworkplan-addon-agentkit
 description: Optional DeepWorkPlan addon that integrates coding-agents-kit (the `ak` command, DailybotHQ/coding-agents-kit pinned at v1.0.1, interface 1) as the headless delegation transport - a thin integrator that detects the kit through `ak doctor --json`, offers it (never imposes it) from onboard Phase 7b, documents the install from a clone of the pinned tag plus the kit's install.sh, records the acceptance in the .dwp/config.json addon registry, and maps a v7 plan's delegation operations (launch, observe, collect, cancel) onto one `ak run` per delegate in a dedicated git worktree. Never required, never a conformance gate. The kit launches agents in autonomy by default and its opt-out (--ask or AGENTKIT_PERMISSIONS=ask) always wins; the pack spells no CLI autonomy flag, never passes --auto, and passes --ask always for a read-only delegate and for writing delegates when a plan records the opt-out.
-version: "7.8.1"
+version: "7.9.0"
 documentation_url: https://deepworkplan.com/kit/agentkit
 user-invocable: true
 allowed-tools: Bash, Read, Grep, Glob, Edit, Write

.agents/skills/deepworkplan/addons/ai-diff-reviewer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: deepworkplan-addon-ai-diff-reviewer
 description: "DeepWorkPlan addon — required local review (baseline since standard 2.3.0), optional CI surface — connects an AI-first repo to the AI Diff Reviewer. Onboarding installs the vendored coding-agent skill and extension with consent; the Final Review runs the local pass when present or records a missing-reviewer finding without bootstrapping. Flow B CI setup remains an explicit opt-in delegated to upstream. Invocation errors never block, completed-review critical findings still follow the Final Review contract, and all install/auth/wizard details defer to upstream consent flows."
-version: "7.8.1"
+version: "7.9.0"
 documentation_url: https://deepworkplan.com
 user-invocable: true
 allowed-tools: Bash, Read, Grep, Glob, Edit, Write
@@ -12,7 +12,7 @@ metadata: {"openclaw":{"emoji":"🔍","homepage":"https://deepworkplan.com","req
 
 Connect the target repo to the **[AI Diff Reviewer](https://github.com/DailybotHQ/ai-diff-reviewer)**
 (GitHub repo `DailybotHQ/ai-diff-reviewer`, marketplace listing **"AI Diff
-Reviewer"**, pinned **v3.3.14**, moving `@v3` for workflows) so DWP work — the mandatory security pass of
+Reviewer"**, pinned **v3.3.16**, moving `@v3` for workflows) so DWP work — the mandatory security pass of
 the mandatory **Final Review** — runs a structured local review (verdict +
 findings table + severity), and (in Flow B, optionally) every pull request is
 gated by the same review in CI. Since standard 2.3.0 the **local review is part
@@ -21,7 +21,7 @@ reconciles it, and every Final Review runs it. Only the CI surface is opt-in.
 
 > ## The rule that overrides everything: this addon DEFERS, it does not reinvent
 >
-> The upstream **`DailybotHQ/ai-diff-reviewer`** skill (pinned **v3.3.14**;
+> The upstream **`DailybotHQ/ai-diff-reviewer`** skill (pinned **v3.3.16**;
 > moving `@v3` for workflows) already owns install, review methodology, the
 > CI-workflow wizard, the extension-file authoring flow, the PR-body drafting
 > flow, and the post-CI review walkthroughs — as six coordinated sub-skills
@@ -57,7 +57,7 @@ A repo with **zero optional addons** is fully conformant.
 
 ## Two officially-supported adoption flows
 
-The upstream skill (v3.3.14, the documented pin; moving `@v3` for workflows) ships a router plus six sub-skills (review, generate-extension, setup, open-pr, apply-review, address-review). This addon applies Flow A
+The upstream skill (v3.3.16, the documented pin; moving `@v3` for workflows) ships a router plus six sub-skills (review, generate-extension, setup, open-pr, apply-review, address-review). This addon applies Flow A
 as the baseline every onboarded repo gets and offers Flow B as an explicit
 opt-in; it MUST NOT install the CI surface unrequested.
 
@@ -161,7 +161,7 @@ explicitly rather than implied:
 
 | Artifact | Source | How it is verified |
 |----------|--------|--------------------|
-| Vendored skill (six sub-skills) | `DailybotHQ/ai-diff-reviewer` at a **published tag** (documented pin `v3.3.14`) | `skills` CLI records source + content hash in the repo's `skills-lock.json`; a restore re-verifies the hash. Installs are consent-gated (Step 1) and always tag-pinned — never a moving branch. |
+| Vendored skill (six sub-skills) | `DailybotHQ/ai-diff-reviewer` at a **published tag** (documented pin `v3.3.16`) | `skills` CLI records source + content hash in the repo's `skills-lock.json`; a restore re-verifies the hash. Installs are consent-gated (Step 1) and always tag-pinned — never a moving branch. |
 | CI Action (Flow B only) | `DailybotHQ/ai-diff-reviewer` GitHub Action, referenced by an explicitly chosen exact tag or its moving `@v3` major line | Each Action release in the `@v3` line ships a `prompt.md` **byte-identical** to the skill's at the matching skill tag — an upstream CI invariant. The skill side is pinned to an exact tag; the Action follows its major line, so reviews stay compatible while picking up patch fixes. |
 | Extension file | Generated **locally** by `generate-extension` from the repo's own diff | Never downloaded; reviewed by the developer like any other tracked file. |
 | Provider secret (Flow B only) | The maintainer's selected provider credential, configured through upstream setup | This addon never reads, stores, echoes, or commits provider secrets. |
@@ -210,9 +210,9 @@ Run the pinned install unless the developer explicitly declined in Step 0
 (declared exception). **Never run an unpinned installer.**
 
 - **Vendored coding-agent skill** (recommended — brings the six-sub-skill
-  router and the byte-identical prompt parity guarantee; pinned **v3.3.14**;
+  router and the byte-identical prompt parity guarantee; pinned **v3.3.16**;
   the moving `@v3` is the documented default pin for CI workflows):
-  - `npx --yes skills add https://github.com/DailybotHQ/ai-diff-reviewer/tree/v3.3.14 --skill ai-diff-reviewer -y`
+  - `npx --yes skills add https://github.com/DailybotHQ/ai-diff-reviewer/tree/v3.3.16 --skill ai-diff-reviewer -y`
     (**pinned to a published tag**; vendors into
     `.agents/skills/ai-diff-reviewer/` and records source + content hash in
     `skills-lock.json`; both `--yes` and `-y` are required — `--yes` covers

.agents/skills/deepworkplan/addons/ai-diff-reviewer/SPEC.md

@@ -6,7 +6,7 @@ This document is the **normative specification** of the DeepWorkPlan **AI Diff
 Reviewer addon**: a capability — **required in its local form since standard
 2.3.0, optional in its CI form** — that connects an AI-first repository to
 the **AI Diff Reviewer** (`DailybotHQ/ai-diff-reviewer`, marketplace listing
-"AI Diff Reviewer", pinned **v3.3.14**, moving `@v3` for workflows) so DWP work — the mandatory
+"AI Diff Reviewer", pinned **v3.3.16**, moving `@v3` for workflows) so DWP work — the mandatory
 security pass of the mandatory **Final Review** — is augmented with a structured local review
 (verdict + findings table + severity), and (in **Flow B — dual-surface**,
 optionally) every pull request to the target repo is gated by a CI-side
@@ -33,7 +33,7 @@ CI surface is never required.
 | **Status** | Stable |
 | **Companions** | `SKILL.md`, `templates/INTEGRATION.md`, `../README.md`, `spec/ADDONS.md`, `../../create/SKILL.md`, `../../guide/authoring.md` §5.4 |
 | **License** | MIT |
-| **Upstream reference** | `DailybotHQ/ai-diff-reviewer` v3.3.14 (marketplace: "AI Diff Reviewer"); workflows pin the moving `@v3` |
+| **Upstream reference** | `DailybotHQ/ai-diff-reviewer` v3.3.16 (marketplace: "AI Diff Reviewer"); workflows pin the moving `@v3` |
 
 ## 1. Conventions
 
@@ -102,7 +102,7 @@ upstream CI's `Skills — prompt-sync invariant` job).
 
 ## 3. Two Supported Adoption Flows
 
-The upstream skill (pinned v3.3.14; the moving `@v3` for workflows) defines two flows explicitly. This addon applies
+The upstream skill (pinned v3.3.16; the moving `@v3` for workflows) defines two flows explicitly. This addon applies
 Flow A as the baseline and **MUST** offer Flow B as an explicit opt-in.
 
 ### 3.1 Flow A — local-only
@@ -159,12 +159,12 @@ acceptance — each reconciled if already present (§8):
 - The addon **MUST** install the vendored skill (the only supported install
   path) unless the developer recorded a declared exception (§2).
   Supported install method:
-  - `npx --yes skills add https://github.com/DailybotHQ/ai-diff-reviewer/tree/v3.3.14 --skill ai-diff-reviewer -y`
+  - `npx --yes skills add https://github.com/DailybotHQ/ai-diff-reviewer/tree/v3.3.16 --skill ai-diff-reviewer -y`
     (**tag-pinned**; both flags are required — `--yes` covers npm's own "Ok to
     proceed?" prompt; the subcommand `-y` covers the `skills` CLI's own "Which
     agents do you want to install to?" picker, which hangs in non-TTY without
     it — upstream fixed this bug in v1.7.0. Pin the current published tag at
-    install time (here `@v3.3.14`); the moving `@v3` is the documented default
+    install time (here `@v3.3.16`); the moving `@v3` is the documented default
     pin for CI workflows. The pin is what makes the install verifiable and
     the local↔CI parity guarantee exact.)
   - Bump to the latest published tag: `npx --yes skills update ai-diff-reviewer -y`.
@@ -565,7 +565,7 @@ A repo is **conformant to this addon** when **all** hold (after acceptance):
 - `SKILL.md` (the onboarding hook + flow), `templates/INTEGRATION.md` (reasoning aid)
 - `../README.md` (addon mechanism), [`../../spec/ADDONS.md`](../../spec/ADDONS.md) (concept + pointer)
 - Upstream skill: [`DailybotHQ/ai-diff-reviewer`](https://github.com/DailybotHQ/ai-diff-reviewer)
-  — `skills/ai-diff-reviewer/SKILL.md` (documented pin **v3.3.14**; workflows
+  — `skills/ai-diff-reviewer/SKILL.md` (documented pin **v3.3.16**; workflows
   use the moving `@v3`), sub-skills: `generate-extension/SKILL.md`,
   `setup/SKILL.md` +
   [`setup/reference.md`](https://github.com/DailybotHQ/ai-diff-reviewer/blob/main/skills/ai-diff-reviewer/setup/reference.md),