Prepublish Gate Cleanup — Senpi flag-gate, payload hygiene, gate fixes

TL;DR

Summary: Deactivate the public Senpi surface behind a purpose-built env flag and remove its payload from the root npm tarball (blocker 3), fix LazyCodex payload hygiene (workflow-selector residue + nested node_modules — blocker 4), and tidy the remaining publish-gate defects (serve.js recurring mode-bit dirt, Senpi/Pi leakage in generated release notes). Deliverables: senpi-platform-flag module + CLI/TUI gating; root files[] senpi removal + flipped contract test; publish.yml lazycodex files-override negations; script/verify-npm-payload.mjs pack-time guard wired into both publish paths; static containment test; serve.js tracked as 755; changelog Senpi/Pi filter + tests; QA evidence under .omo/evidence/20260707-gate-cleanup/. Effort: Medium Risk: Medium - touches the npm publish payload contract and release workflow; mitigated by pack dry-run RED/GREEN evidence and pack-time guards. Decisions: D1 (default, reversible): flag = env var OMO_ENABLE_SENPI_PLATFORM ("1"/"true"), module packages/omo-opencode/src/cli/senpi-platform-flag.ts; gates at commander choices (both option blocks), TUI platform prompt, and a resolveInstallArgs backstop. Installer/validator internals untouched (source-checkout escape hatch stays functional). D2 (default, reversible): remove packages/omo-senpi/plugin from root files[]; flip script/senpi-test-script.test.ts payload pin from inclusion to exclusion; add "private": true to packages/omo-senpi/plugin/package.json. D3 (default, reversible): serve.js tracked mode becomes 100755 to match what bun build emits every build (ends the recurring dirty-worktree bit); alternative (chmod 644 post-build step) rejected as toolchain-fighting. D4 (default, reversible): changelog filter = word-boundary regex \bsenpi\b|\bpi-goal\b|\bpi-webfetch\b (case-insensitive) applied to commit subjects in both the commit list and the contributors section. D5 (default): version bump stays publish-workflow-owned; NOT touched locally (repo rule). D6 (default): delivery = ONE PR to dev from an isolated worktree, atomic commits, merge-commit policy.

Context

Original request

"플래그같은거 우리가 잘 설계해서 만들어서, 3은 비활성화 시켜주고, 4도 정리해주고 해주라. 그리고 나머지 게이트에서도 수정들 잘 정리도 좀 해주라." — referring to blockers 3 (Senpi exposure) and 4 (LazyCodex payload hygiene) from .omo/evidence/20260707-prepublish-review/final-synthesis-ko.md, plus tidying the other gate findings. Original release constraint (from the reviewed thread): non-omo/lazycodex surfaces must not be published now, "using feature flag / or just not configured yet".

Interview summary

User gave a standing mandate ("cc ulw plan and continue on a work") — plan generated under the autonomous-mandate exception; all defaults announced in TL;DR Decisions for veto.

Research findings

packages/omo-opencode/src/cli/cli-program.ts:82 (install subcommand, hideHelp()) and :94 (root-level, visible) both hardcode .choices(["opencode", "codex", "both", "senpi"]). resolveInstallArgs is at cli-program.ts:49. → these are the flag gate points.
packages/omo-opencode/src/cli/tui-install-prompts.ts:34-38 unconditionally offers the Senpi option. → third gate point.
packages/omo-opencode/src/cli/install-platform-resolution.test.ts:116,131 grep the cli-program.ts SOURCE for the literal choices string; :51 tests --platform=senpi resolves. → tests must flip to the flag-gated contract.
Root package.json files[] ships packages/omo-senpi/plugin (13 files in pack dry-run); script/senpi-test-script.test.ts pins that inclusion AND pins build:senpi-plugin + build orchestrator references (keep the build pins — local senpi dev needs artifacts; only the payload pin flips).
packages/omo-codex/plugin/components/workflow-selector/dist/cli.js is untracked + gitignored (.gitignore:12 dist/) yet packed, because files[] includes the whole plugin dir and npm packs on-disk content. → delete residue + negation + guards.
Root files[] already carries !packages/omo-codex/plugin/node_modules + !packages/omo-codex/plugin/**/node_modules, but .github/workflows/publish.yml:682 REPLACES files[] for lazycodex-ai WITHOUT those negations → published [email protected] ships 2,217 node_modules entries (~699MB unpacked, verified by npm pack [email protected]).
git log on serve.js: 7960abb16 deliberately restored 100644, but the codegraph component build (bun build src/serve.ts --outfile dist/serve.js, packages/omo-codex/plugin/components/codegraph/package.json:17) re-emits 755 on every build (sibling cli.js is already tracked 755). → recurring dirt; track 755.
script/generate-changelog.ts:23 filters only ignore:|test:|chore:|ci:|release:; contributors section (:117) same. No Senpi/Pi exclusion → Senpi commit subjects leak into GitHub release notes.
bin/platform.js / postinstall.mjs: zero senpi references — no work there.
publish.yml insertion points: root-payload guard fits after "Build Codex plugin components" (~line 600) before "Publish oh-my-opencode" (line 630); lazycodex guard fits inside "Publish lazycodex-ai" (line 671) after the jq files-override rewrite, before npm publish.

Metis review

Adapted (harness has no metis subagent): gap analysis folded from the 7 team artifacts of the 2026-07-07 prepublish review. Gaps covered: (a) lazycodex override pack was never verified with the rewritten files list → task 3 QA simulates the exact jq rewrite and packs; (b) release-note leakage had no in-code fix → task 5; (c) mode-bit dirt had no root-cause fix → task 4 aligns tracked mode with build output; (d) guard permanence → pack-time script wired into publish.yml, not just a one-off check.

Scope

Must have

Flag module with env OMO_ENABLE_SENPI_PLATFORM; default OFF removes senpi from both commander choices lists, the TUI platform prompt, and rejects platform === "senpi" in resolveInstallArgs with an actionable message; flag ON restores all three.
Root npm tarball contains zero packages/omo-senpi/** paths (pack dry-run proof).
Root and lazycodex-override packs contain zero node_modules/ and zero components/workflow-selector/ paths (pack dry-run proof for both).
script/verify-npm-payload.mjs fails (exit non-zero, named offending paths) on forbidden patterns; wired into publish.yml before root publish and before lazycodex-ai publish.
serve.js tracked mode 100755; rebuilding the codegraph component leaves git status clean.
script/generate-changelog.ts excludes Senpi/Pi subjects from both the commit list and contributors sections; existing prefix filters unchanged.
Full root bun test + bun run typecheck green; QA evidence captured under .omo/evidence/20260707-gate-cleanup/.

Must NOT have (guardrails)

NO local version bump (publish-workflow-owned; repo hard rule).
NO changes to senpi installer/validator internals beyond the three gate points (escape hatch must keep working from a source checkout with the flag on).
NO deletion/weakening of existing tests to green the suite — pins are FLIPPED to the new contract, with flag-on cases preserving old behavior coverage.
NO edits to packages/omo-codex component runtime behavior (payload/packaging only).
NO squash/rebase merge language anywhere; PR targets dev.
NO broad \bpi\b filter in the changelog (must not swallow "api"/unrelated subjects).

Verification strategy

Zero human intervention - all verification is agent-executed.

Test decision: TDD (bun:test, given/when/then style per repo convention) — every behavior change gets a failing-first proof before production code.
QA policy: CLI- and data-shaped work — auxiliary surfaces are first-class: real CLI invocations (exit codes + stderr), npm pack --dry-run --json payload dumps, git status --short after real rebuild, real bun script/generate-changelog.ts output.
Evidence: .omo/evidence/20260707-gate-cleanup/task-<N>-<slug>.<ext> (kept inside the repo per repo evidence convention; plan template's .omo/evidence/task-N naming adapted to the repo's dated-dir convention).

Execution strategy

Parallel execution waves

Wave 1 (no deps): 1, 2, 4, 5 Wave 2 (after 1-2): 3 Critical path: 2 → 3 → F-wave

Dependency matrix

Todo	Depends on	Blocks	Can parallelize with
1	none	3 (containment test asserts CLI contract too)	2, 4, 5
2	none	3	1, 4, 5
3	1, 2	F-wave	none
4	none	F-wave	1, 2, 5
5	none	F-wave	1, 2, 4

TODOs

Implementation + its test = ONE todo. Never separate them.

Final Verification Wave

Runs in parallel after ALL todos. Each reviewer returns APPROVE or REJECT. Any REJECT -> fix -> re-run only the rejecting reviewer.

F1. Plan compliance audit - read the plan end-to-end; verify every Must Have exists (run the pack dry-runs, read the flag module, grep publish.yml), every Must NOT Have is absent (no version bump, no installer-internals edits, no test deletions), every evidence file exists under .omo/evidence/20260707-gate-cleanup/.
F2. Code quality review - bun run typecheck + full bun test; review changed files for as any / empty catches / debug prints / dead code / slop; actionlint .github/workflows/publish.yml.
F3. Real manual QA - from the worktree, re-execute EVERY QA scenario from every todo (flag off/on CLI runs, both pack dry-runs, guard RED/GREEN, rebuild-clean check, changelog run); save to .omo/evidence/20260707-gate-cleanup/final-qa/.
F4. Scope fidelity check - per todo, diff spec vs actual changes; git diff dev...HEAD --stat shows only planned files; no cross-task contamination, no unaccounted files.

Commit strategy

todo 1: feat(cli): gate senpi install platform behind OMO_ENABLE_SENPI_PLATFORM - cli files | pre-commit: bun test packages/omo-opencode/src/cli/
todo 2: fix(publish): stop shipping senpi plugin payload in root npm package - package.json, senpi test, plugin pkg | pre-commit: bun test script/senpi-test-script.test.ts
todo 4: chore(codegraph): track serve.js bundle as executable to match build output - serve.js mode | pre-commit: git status --short clean after rebuild
todo 5: feat(release): filter senpi and pi surfaces out of generated release notes - changelog script + test | pre-commit: bun test script/generate-changelog.test.ts
todo 3: fix(publish): exclude nested node_modules and stale component residue from npm payloads - package.json, publish.yml, guard script + test | pre-commit: bun test script/npm-payload-containment.test.ts && node script/verify-npm-payload.mjs
PR to dev, merge-commit policy (NEVER squash/rebase). Footer: Plan: .omo/plans/prepublish-gate-cleanup.md

Success criteria

Verification commands

npm pack --dry-run --json --ignore-scripts | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{const f=JSON.parse(d)[0].files.map(x=>x.path);const bad=f.filter(p=>p.includes('node_modules/')||p.startsWith('packages/omo-senpi/')||p.includes('components/workflow-selector/'));console.log('bad:',bad.length);process.exit(bad.length?1:0)})" -> bad: 0, exit 0
env -u OMO_ENABLE_SENPI_PLATFORM bun packages/omo-opencode/src/cli/index.ts install --no-tui --platform=senpi -> non-zero exit, senpi not accepted
node script/verify-npm-payload.mjs -> exit 0
bun run --cwd packages/omo-codex/plugin/components/codegraph build && git status --short packages/omo-codex/plugin/components/codegraph/dist/ -> empty
bun test -> green; bun run typecheck -> green
bun script/generate-changelog.ts | grep -icE "\bsenpi\b|\bpi-goal\b|\bpi-webfetch\b" -> 0