OpenCode plugin 0.1.4

OpenCode plugin 0.1.4 ships the latest master changes: explicit scope policy across review, validation, application and resume, plus visible scope tags in Markdown and HTML review reports.

Set the exact plugin pin in your OpenCode config and restart while online:

{ "plugin": ["opencode-multi-llm@0.1.4"] }

Tested host: OpenCode 1.19.5 on Linux. macOS and Windows remain untested on the npm installation route. Keep the other entries and settings in your existing config. Project .multi-llm/providers.yaml stays in place; this release needs no provider-config migration. Users switching from the file-command route should remove the old file command before enabling the npm plugin to avoid duplicate commands.

All nine canonical fresh-registry criteria passed: exact package integrity and tree, manifest version, installed command, actual payload execution, cold dependency installation, offline operation with network cut, same-pin restart, and a real 0.1.3 → 0.1.4 upgrade executing the new payload. No paid model requests were used.

Immutable tag source: 89fea1893ec332fc5462c5b95ee712404a898d32. Accepted npm provenance identifies certified publishing source 8d605c9b9d74ba6b4580081838296126212d8802 on refs/heads/master, repository beastlabai/multi-llm-plugin, workflow .github/workflows/publish-opencode-plugin.yml. Its rebuilt package digest exactly equals the independently gated tag: bcdf5f4fb5f402dad25402603e49497180050acdd1d07f59ba6ea5a51d5ca905.

Registry integrity:

sha512-qajLxl8eSG2qzkmwEDYgW301/xd4rN+CPq59Al3STbc0cjtH1A5rtY69S3sVr9NC07EBi0FEV762zsDrjDYqcQ==

All four required PR and master CI checks and both local/tag release gates passed. Publish: successful OIDC workflow.

Attached evidence: 20261101T004126Z-opencode-release-gate.json, 20261101T061412Z-opencode-release-network-check.json (also committed under skills/multi-llm/tests/container/records/), certified-source-equivalence.json, and npm-provenance-verification.json.