opencode: two profiles, per-profile permissions, shared agent prompts

oc-work: local models only on the local key, edits and most commands ask,
loads instructions/work.md. oc-local (also oc, opencode): every model,
defaults to qwen3.8-flash-next-iq3s-med, edits and commands run except
destructive and outward-facing ones. On sctfw004 oc-local presents the work
key. personal.json and work-strict.json removed.

Agents: drop variant, which has no effect on LiteLLM models. dev takes its
permissions from the profile. The read-only agents deny redirects and the
write/exec flags of allowed commands, swap find for fd, and only allow
listing forms of git branch. review defaults to the uncommitted diff.

CLAUDE.md: add the comment, process and shell-tool rules from the laptop's
AGENTS.md, and note that OpenCode reads this file.

common/claude/memory/-home-connor/MEMORY.md

@@ -1,7 +1,7 @@
 - [No AI commit attribution](no-ai-commit-attribution.md) — plain commit messages, no Co-Authored-By or session trailers
 - [Zen ToS hold](zen-tos-hold.md) — no Zen endpoints until Connor says the flag is cleared
 - [podman-compose bind-mount restart](podman-compose-bind-mount-restart.md) — config edits need podman restart; replacing a single-file mount (Caddyfile) leaves the container on the old inode
-- [Work vs personal LLM profiles](llm-work-personal-profiles.md) — work is US-gov adjacent: OpenAI + local only, no Anthropic
+- [Work vs personal LLM profiles](llm-work-personal-profiles.md) — work is US-gov adjacent: local + OpenAI, never Anthropic; OpenCode is oc-work (local, tight) and oc-local (all, looser)
 - [Claude Code quota source](claude-code-quota-source.md) — statusLine rate_limits is the only supported read; no server-side API
 - [Grafana Claude Code blind spot](grafana-claude-code-blindspot.md) — llm-anthropic board sees mainframe only, not work_laptop
 - [Reasoning effort per model](litellm-extra-body-reasoning.md) — GLM-5.3 defaults to reasoning_effort=max and cannot disable thinking; gpt-oss needs chat_template_kwargs via extra_body

common/claude/memory/-home-connor/llm-work-personal-profiles.md

@@ -1,8 +1,11 @@
 ---
 name: llm-work-personal-profiles
-description: Connor's LLM stack has two profiles — work (US-gov adjacent, no Anthropic) and personal — which constrains which providers may serve which agent
+description: "Work is US-gov adjacent (local + OpenAI, never Anthropic); OpenCode profiles are oc-work (local only, tight) and oc-local (all models, looser)"
 metadata:
+  node_type: memory
   type: project
+  originSessionId: 7072f523-c0c5-4db7-9d83-7335663126b5
+  modified: 2026-11-02T15:27:49.563Z
 ---
 
 The LiteLLM stack serves two profiles with different permitted providers:
@@ -22,12 +25,13 @@ Connor has explicitly accepted that the work profile will be less performant
 than personal. That is a deliberate trade — do not propose Anthropic models for
 work to close the gap.
 
-**How to apply:** when recommending a model for anything work-related, pick from
-`openai/*` or local. Enforcement is currently by convention only; the plan
-(Phase 3e of the OMO plan doc) proposes per-profile LiteLLM virtual keys with
-model allowlists to make it a real control.
+Since 2026-11-02 Connor leans toward local models for all OpenCode work because
+of his employer's AI policy. OpenCode has two profiles: `oc-work` (local models
+only via the LiteLLM `local` key, tight permissions, extra work instructions)
+and `oc-local` (every model, defaults to local Qwen3.8, looser permissions,
+`personal` key except on sctfw004 where it presents the `work` key).
 
-Full plan and measured findings live in the OMO plan doc, kept at
-`/tmp/omo-plan.md` as a scratch file (Connor's `docs/projects/` is reserved for
-git projects, so the plan does not belong there). Ask him for the current copy
-rather than assuming that path survived a reboot.
+**How to apply:** when recommending a model for anything work-related, prefer
+local, then `openai/*`. Enforcement is by LiteLLM virtual key, so the thing to
+check after any launcher change is which key each command presents on each
+host. Details in `~/guides/llm/robots.md` §2.