feat(root): implement per-agent vendor dispatch and add new agents

Refine vendor detection logic across all supported CLIs.
Add architecture-reviewer and tf-infra-engineer agents.
Update documentation to reflect new dispatch strategy.
Fix hook script existence checks and path configurations.

Co-Authored-By: First Fluke <our.first.fluke@gmail.com>

Author: gracefullight

.agents/agents/architecture-reviewer.md

@@ -0,0 +1,41 @@
+---
+name: architecture-reviewer
+description: Architecture review and recommendation. Use for system design, module boundaries, ADRs, and tradeoff analysis.
+skills:
+  - oma-architecture
+---
+
+You are an Architecture Specialist. Diagnose the architectural concern before recommending a solution. Use the lightest sufficient method for the decision at hand and compare at least two materially different options when the decision is significant.
+
+## Execution Protocol
+
+Follow the vendor-specific execution protocol:
+- Write results to project root `.agents/results/result-architecture.md` (orchestrated: `result-architecture-{sessionId}.md`)
+- Include: status, recommendation summary, tradeoffs, risks, validation steps, artifacts created
+
+## Charter Preflight (MANDATORY)
+
+Before ANY recommendations or structural edits, output this block:
+
+```
+CHARTER_CHECK:
+- Clarification level: {LOW | MEDIUM | HIGH}
+- Task domain: architecture
+- Must NOT do: {3 constraints from task scope}
+- Success criteria: {measurable criteria}
+- Assumptions: {defaults applied}
+```
+
+- LOW: proceed with assumptions
+- MEDIUM: list options, proceed with most likely
+- HIGH: set status blocked, list questions, DO NOT change architecture or code
+
+## Rules
+
+1. State the architecture problem explicitly before proposing options
+2. Distinguish architecture from UI design, PM planning, and Terraform delivery
+3. Compare implementation cost, operational cost, team complexity, and future change cost
+4. Surface assumptions, risks, and validation steps in every recommendation
+5. Save ADRs or architecture notes under `.agents/results/architecture/` when material
+6. Only modify code when the task explicitly requires implementation, not just review
+7. Never modify `.agents/` files

.agents/agents/tf-infra-engineer.md

@@ -0,0 +1,42 @@
+---
+name: tf-infra-engineer
+description: Terraform infrastructure implementation and review. Use for cloud provisioning, IAM/OIDC, networking, and terraform plan review.
+skills:
+  - oma-tf-infra
+---
+
+You are a Terraform Infrastructure Specialist. Detect the provider and existing IaC layout before writing HCL. Prefer reusable modules, least-privilege IAM, and remote state with locking.
+
+## Execution Protocol
+
+Follow the vendor-specific execution protocol:
+- Write results to project root `.agents/results/result-tf-infra.md` (orchestrated: `result-tf-infra-{sessionId}.md`)
+- Include: status, summary, files changed, validation results, plan/apply notes, acceptance checklist
+
+## Charter Preflight (MANDATORY)
+
+Before ANY infrastructure changes, output this block:
+
+```
+CHARTER_CHECK:
+- Clarification level: {LOW | MEDIUM | HIGH}
+- Task domain: tf-infra
+- Must NOT do: {3 constraints from task scope}
+- Success criteria: {measurable criteria}
+- Assumptions: {defaults applied}
+```
+
+- LOW: proceed with assumptions
+- MEDIUM: list options, proceed with most likely
+- HIGH: set status blocked, list questions, DO NOT apply destructive changes
+
+## Rules
+
+1. Detect provider and existing module layout before writing new Terraform
+2. Run `terraform fmt`, `terraform validate`, and `terraform plan` before reporting complete when Terraform is present
+3. Use remote state, version pinning, and least-privilege IAM by default
+4. Prefer OIDC/workload identity over long-lived static credentials
+5. Do not hardcode secrets in `.tf` files or examples
+6. Document cost, drift, rollback, and continuity considerations for production changes
+7. Never run destructive operations without explicit user approval
+8. Never modify `.agents/` files

.agents/agents/variants/agent-variant.schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "title": "Agent Variant Configuration",
-  "description": "Configuration for vendor-specific agent generation from core prompts",
+  "description": "Configuration for vendor-specific agent generation from core agent prompts",
   "type": "object",
   "required": ["vendor", "destDir", "modelDefault", "toolsDefault", "protocolPath", "agents"],
   "properties": {
@@ -10,7 +10,7 @@
     },
     "vendor": {
       "type": "string",
-      "description": "The target CLI vendor name (e.g., gemini, claude)"
+      "description": "The target CLI vendor name (e.g., claude, codex, gemini)"
     },
     "destDir": {
       "type": "string",
@@ -42,7 +42,7 @@
     },
     "agents": {
       "type": "object",
-      "description": "Map of agent-id to vendor-specific overrides",
+      "description": "Map of agent-id to vendor-specific overrides for generated Markdown or TOML agent files",
       "additionalProperties": {
         "type": "object",
         "properties": {

.agents/agents/variants/claude.json

@@ -15,6 +15,14 @@
     "debug-investigator": {
       "maxTurns": 15
     },
+    "architecture-reviewer": {
+      "tools": "Read, Write, Edit, Bash, Grep, Glob",
+      "maxTurns": 15
+    },
+    "tf-infra-engineer": {
+      "tools": "Read, Write, Edit, Bash, Grep, Glob",
+      "maxTurns": 20
+    },
     "mobile-engineer": {},
     "pm-planner": {
       "tools": "Read, Write, Grep, Glob, Bash",

.agents/agents/variants/codex.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "./agent-variant.schema.json",
+  "vendor": "codex",
+  "destDir": ".codex/agents",
+  "modelDefault": "gpt-5.4",
+  "toolsDefault": [],
+  "protocolPath": ".agents/skills/_shared/runtime/execution-protocols/codex.md",
+  "agents": {
+    "backend-engineer": {
+      "extra": {
+        "sandbox_mode": "workspace-write"
+      }
+    },
+    "frontend-engineer": {
+      "extra": {
+        "sandbox_mode": "workspace-write"
+      }
+    },
+    "db-engineer": {
+      "effort": "medium",
+      "extra": {
+        "sandbox_mode": "workspace-write"
+      }
+    },
+    "debug-investigator": {
+      "effort": "high",
+      "extra": {
+        "sandbox_mode": "workspace-write"
+      }
+    },
+    "architecture-reviewer": {
+      "effort": "high",
+      "extra": {
+        "sandbox_mode": "read-only"
+      }
+    },
+    "tf-infra-engineer": {
+      "effort": "medium",
+      "extra": {
+        "sandbox_mode": "workspace-write"
+      }
+    },
+    "mobile-engineer": {
+      "extra": {
+        "sandbox_mode": "workspace-write"
+      }
+    },
+    "pm-planner": {
+      "effort": "medium",
+      "extra": {
+        "sandbox_mode": "read-only"
+      }
+    },
+    "qa-reviewer": {
+      "effort": "high",
+      "extra": {
+        "sandbox_mode": "read-only"
+      }
+    }
+  }
+}

.agents/agents/variants/cursor.json

@@ -21,6 +21,11 @@
         "readonly": true
       }
     },
+    "architecture-reviewer": {
+      "extra": {
+        "readonly": true
+      }
+    },
     "debug-investigator": {},
     "mobile-engineer": {
       "extra": {
@@ -37,6 +42,11 @@
         "readonly": true,
         "is_background": true
       }
+    },
+    "tf-infra-engineer": {
+      "extra": {
+        "is_background": true
+      }
     }
   }
 }

.agents/agents/variants/gemini.json

@@ -18,6 +18,8 @@
     "frontend-engineer": {},
     "db-engineer": {},
     "debug-investigator": {},
+    "architecture-reviewer": {},
+    "tf-infra-engineer": {},
     "mobile-engineer": {},
     "pm-planner": {
       "tools": [

.agents/hooks/core/persistent-mode.ts

@@ -203,13 +203,18 @@ async function main() {
       `  2. Or ask the user to say "워크플로우 완료" / "workflow done"`,
     ].join("\n");
 
-    process.stdout.write(makeBlockOutput(vendor, reason));
-    process.exit(2);
+    writeBlockAndExit(vendor, reason);
   }
 
   process.exit(0);
 }
 
+export function writeBlockAndExit(vendor: Vendor, reason: string): never {
+  process.stderr.write(reason);
+  process.stdout.write(makeBlockOutput(vendor, reason));
+  process.exit(2);
+}
+
 if (import.meta.main) {
   main().catch(() => process.exit(0));
 }

.agents/hooks/core/test-filter.ts

@@ -2,6 +2,7 @@
 // Works with: Claude Code, Codex CLI, Gemini CLI, Qwen Code
 
 import { resolveGitRoot, makePreToolOutput, type Vendor } from "./types.ts";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
 
 // --- Vendor detection (same logic as keyword-detector.ts) ---
@@ -130,6 +131,9 @@ const vendor = detectVendor(input);
 const projectDir = getProjectDir(vendor, input);
 const filterScript = join(projectDir, getHookDir(vendor), "filter-test-output.sh");
 
+// Skip filtering if the script doesn't exist (hooks not fully installed)
+if (!existsSync(filterScript)) process.exit(0);
+
 // Rewrite command to pipe through filter
 const filteredCmd = `set -o pipefail; (${command}) 2>&1 | bash "${filterScript}"`;
 

.agents/skills/_shared/core/vendor-detection.md

@@ -1,6 +1,15 @@
 # Vendor Detection Protocol
 
-When executing a workflow, determine your runtime environment using this priority order:
+When executing a workflow, determine your runtime environment using this priority order.
+Then resolve the target vendor for each agent from `.agents/oma-config.yaml` (`agent_cli_mapping`, `default_cli`).
+
+Important:
+- Do **not** choose one spawn strategy for the entire workflow based only on the main runtime vendor.
+- Decide per agent:
+  - `current_runtime_vendor`
+  - `target_vendor_for_agent`
+  - whether that exact runtime can invoke that target vendor natively
+- If native invocation is not available for that agent, fall back to `oma agent:spawn`.
 
 ## Detection Order (use first match)
 
@@ -15,7 +24,23 @@ When executing a workflow, determine your runtime environment using this priorit
 | Vendor | Spawn Method | Result Handling |
 |:---|:---|:---|
 | Claude Code | `Agent` tool with `.claude/agents/{name}.md` | Synchronous return |
-| Codex CLI | Model-mediated parallel subagent request | JSON output |
-| Gemini CLI | `@{agent-name}` delegation or `oma agent:spawn` | MCP memory poll |
-| Antigravity | `oma agent:spawn` only (custom subagents not available) | MCP memory poll |
+| Codex CLI | Native custom agents in `.codex/agents/{name}.toml` via `codex exec "@agent ..."` when available, otherwise `oma agent:spawn` | JSON output |
+| Gemini CLI | `.gemini/agents/{name}.md` native subagents via `gemini -p "@agent ..."` when available, otherwise `oma agent:spawn` | JSON output or MCP memory poll |
+| Antigravity | Prefer `oma agent:spawn` unless a native role-subagent path is explicitly verified for the target vendor | MCP memory poll |
 | CLI Fallback | `oma agent:spawn {agent} {prompt} {session} -w {workspace}` | Result file poll |
+
+## Dispatch Rule
+
+For each agent:
+
+1. Resolve `target_vendor_for_agent` from config
+2. If `target_vendor_for_agent === current_runtime_vendor` and that runtime has a verified native role-subagent path for that vendor, use the vendor variant agent definition
+3. Otherwise, use `oma agent:spawn`
+
+Example:
+- Runtime: Claude Code
+- Mapping: `frontend: claude`, `backend: claude`, `qa: gemini`
+- Result:
+  - `frontend` -> native Claude subagent
+  - `backend` -> native Claude subagent
+  - `qa` -> external Gemini spawn