v0.6.0

One change, and it is a measurement that refused a feature — plus two facts
about code that is already installed. Read the second section before upgrading.

The agent-mapping exclusion stays, and not because the composite failed

auto maps a planned node onto one of your own Claude Code agents. Such a node
holds no Skill tool at all, so it can invoke nothing — not the staged
corpus, not your own skills, whose definitions its settings do load. That
breaks the promise that auto uses the skills you already have, and it lands
by construction on design, review and doc nodes.

ADR 0017 measurement (j), 18 spawns, pre-registered, judged only by planted
marker files and raw Skill tool-use records:

• The composite works — 3 of 3, attributable to the staged corpus.
• Lifting the exclusion would cut no ceiling (see below).
• And it was refused anyway, because for those nodes Skill resolves against a
  corpus the target repository can write. Arm R-D: a SKILL.md committed
  to the fixture repo, the node's prompt mentioning no skill and no corpus,
  byte-identical to a naming prompt minus one sentence — 3 of 3 invoked it,
  and step one of the planted procedure executed. A repository can also load a
  plugin from an arbitrary path through its own committed
  .claude/settings.json.

git clone putting invocable procedure text into an unattended node is a
supply-chain surface, and it is the class ADR 0012 spent 750 lines on before
cutting the feature that opened it.

Two things about the build you are already running

The scope ceiling does not hold on agent-mapped nodes, and has not since
agent mapping shipped. Arm G-T used the argv that ships today — no staged
plugin, no Skill, nothing edited — and an out-of-scope command ran with
permission_denials: []. Arm G-POS is the positive control: the same argv
runs an in-scope command fine, so this is a scope escape and not a missing
tool. A mapped node loads your settings so --agent can resolve, and your
standing grants load with them — so a node declaring Bash(git *) can run a
non-git command if your own settings allow one.

This release does not fix that. It stops claiming otherwise: the plan
printout's (their declared tool list still binds) is gone, replaced per node
by "it holds NO Skill tool, and its declared scope is enforced only as far as
YOUR settings enforce it", with the measurement cited inline. The MCP half of
the guarantee does still hold — mapped nodes keep --strict-mcp-config with no
--mcp-config. Tracked in #161, which is where a fix has to start:
--agent and layer 1 are mutually exclusive, so this is a redesign, not a
patch.

--no-agent <name> — an escape, and what it costs

New flag on auto and chat, repeatable, naming an agent by its frontmatter
name. It declines that one mapping and leaves every other in place. The node
loses its agent — that is the price. In exchange it keeps layer 1 at
--setting-sources "", so its declared scope is enforced again and skill
activation reaches it like any other planned node.

The agent name is the identifier because it exists before you pay the planner;
a node id does not. The decline is applied after candidate selection, so
opting out can never promote a second candidate into a mapping you did not
have — that is pinned by a test.

--no-agent-mapping still turns every mapping off run-wide. It is simply no
longer the only door.

---

All 18 spawns' raw tool-use records, argv captures and pre-registration are
committed under docs/measurements/.

Install: go install github.com/jitokim/oh-my-graph/cmd/oh-my-graph@v0.6.0

Full changelog: https://github.com/jitokim/oh-my-graph/blob/v0.6.0/CHANGELOG.md