fix(daemon): keep binary files byte-identical in rig bundles

Bundle create read every vendored agent-package file, and the declared
culture, docs and startup files, as UTF-8 text and wrote it back as UTF-8.
Any byte sequence that is not valid UTF-8 became U+FFFD, and the integrity
manifest was hashed from the changed copy, so inspect and install verified
the corrupted bytes as intact.

Copy those files as bytes: the pod assembler reads them with readFileBuffer
and writes the same bytes, and the install-side skills and workflow-spec
routers copy with fs.copyFileSync. Rewriting rig.yaml and agent.yaml import
refs stays a text operation.

Refs #245

.evidence/AB-full-suite-preexisting-failures.txt

@@ -1,4 +0,0 @@
-A/B DISCRIMINATOR — full-suite failures are PRE-EXISTING at base
-candidate (be23eb200 + S1): 18 files / 29 tests failed, 7825 passed
-pristine base be23eb200:    18 files / 29 tests failed (identical set, run 05:26Z)
-delta: 0 regressions

.evidence/CLI-TERMINAL-CAPTURES.txt

@@ -1,27 +0,0 @@
-S2 CLI TERMINAL CAPTURES — built CLI (worktree dist) against a stub serving the route-test-proven payload shapes. env-less = no OPENRIG_SESSION_NAME.
-
-$ rig send dev-impl@my-rig 'hello' (env-less single send):
-Sent to dev-impl@my-rig
-Advisory: Delivered without sender identity: this request carried no X-OpenRig-Session header, so your recipient has no way of knowing who sent it. Follow up and sign it — send from a seat shell (the header stamps automatically) or state your identity in the message body.
-
-$ rig send --to dev-impl@my-rig,dev-qa@my-rig 'hello team' (env-less fan-out):
-dev-impl@my-rig: sent
-dev-qa@my-rig: sent
-2/2 delivered
-Advisory: Delivered without sender identity: this request carried no X-OpenRig-Session header, so your recipient has no way of knowing who sent it. Follow up and sign it — send from a seat shell (the header stamps automatically) or state your identity in the message body.
-
-$ rig broadcast --rig my-rig 'hello all' (env-less broadcast):
-Error: Daemon did not respond — it may be busy or stopped (state not confirmed).
-  This command needs a responsive daemon; the outcome of proceeding would be indeterminate.
-  Re-check with 'rig daemon status'. If it is confirmed stopped, run 'rig up' or 'rig daemon start'.
-
-$ attributed single send (OPENRIG_SESSION_NAME set) — no nag:
-Sent to dev-impl@my-rig
-
-NOTE on the broadcast capture: `rig broadcast` runs a daemon-liveness preflight
-(StatusDeps state-file check) before any HTTP, which a bare stub cannot satisfy —
-the refusal above is that preflight, unrelated to S2. The broadcast RENDERER's
-terminal output is proven by the focused test "broadcast renderer surfaces the
-unknown-sender notice from the response warning" (broadcast.test.ts, captureLogs
-asserts the Advisory line on non-JSON output), and the renderer code path is
-byte-shared with the fan-out renderer captured live above.

.evidence/CONTRACT-F4-amended-hashes.txt

@@ -1,2 +0,0 @@
-14c99a2bae7e79b213191233e19768fb37ae56fd97dbd55cb9ad709989b75077  /Users/admin/.openrig-build-vm-2d5beac5/workspace/missions/release-0.5.4/slices/06-delivery-honesty/SPEC.md
-fca29b492ac7bee26fc02a3a2aa5285ab74f9f8c2b94ace2287b7d6b29501a0a  /Users/admin/.openrig-build-vm-2d5beac5/workspace/missions/release-0.5.4/slices/06-delivery-honesty/IMPLEMENTATION-PRD.md

.evidence/ERROR-TEXTS-captured.txt

@@ -1,27 +0,0 @@
-ERROR TEXT — ACTUAL EMITTED SPECIMENS (captured by running the real
-SessionTransport over the real TmuxAdapter with injected exec failures;
-harness: test/zz-scratch-capture-specimens.test.ts, run once and deleted)
-
-send / no-server:
-  reason: tmux_unavailable
-  error:  The tmux server could not be reached (no server running on /private/tmp/tmux-501/default). Whether session 'dev-impl@my-rig' exists was not determined. No text was sent.
-
-send / socket-gone:
-  reason: tmux_unavailable
-  error:  The tmux server could not be reached (error connecting to /private/tmp/tmux-501/default (No such file or directory)). Whether session 'dev-impl@my-rig' exists was not determined. No text was sent.
-
-send / genuine absence:
-  reason: session_missing
-  error:  Session 'dev-impl@my-rig' not found: tmux reports no session with this name. No text was sent. Check available sessions with: rig ps --nodes
-
-send / permission-denied (unexpected probe failure):
-  reason: tmux_unavailable
-  error:  The tmux session probe failed unexpectedly (permission denied). Whether session 'dev-impl@my-rig' exists was not determined. No text was sent.
-
-capture / no-server:
-  reason: tmux_unavailable
-  error:  The tmux server could not be reached (no server running on /private/tmp/tmux-501/default). Whether session 'dev-impl@my-rig' exists was not determined. Nothing was captured.
-
-capture / genuine absence:
-  reason: session_missing
-  error:  Session 'dev-impl@my-rig' not found: tmux reports no session with this name. Nothing was captured. Check available sessions with: rig ps --nodes

.evidence/JSON-AGGREGATE-INSPECTION.txt

@@ -1,38 +0,0 @@
-S3 round-3 live JSON inspection — built CLI, one consumed + one staged-unresolved recipient (raw transport sent:2):
-
-{
-    "total": 2,
-    "sent": 1,
-    "failed": 1,
-    "results": [
-        {
-            "ok": false,
-            "sessionName": "staged-session",
-            "verified": false,
-            "outcome": "staged-not-consumed",
-            "error": "staged, not consumed (pane effect); the one guarded submit did not clear it"
-        },
-        {
-            "ok": true,
-            "sessionName": "consumed-session"
-        }
-    ],
-    "effectChecks": [
-        {
-            "sessionName": "staged-session",
-            "effect": {
-                "checked": true,
-                "state": "staged",
-                "remedy": "submitted-still-staged"
-            }
-        },
-        {
-            "sessionName": "consumed-session",
-            "effect": {
-                "checked": true,
-                "state": "no-staged-residual"
-            }
-        }
-    ]
-}
-exit: 0

.evidence/PRD-before-F4-amendment.md

@@ -1,49 +0,0 @@
----
-id: OPR.0.5.4.6
-slice: 06-delivery-honesty
-mission: release-0.5.4
-status: intent
-stage: wip
-created: 2026-08-26
----
-
-<!-- ELASTIC MIDDLE (three-capture-points doctrine): the SDLC fixes exactly
-     three capture points — intent → proportional structured requirement →
-     proof. Everything between is ELASTIC. For a small slice the
-     mini-requirements below may BE the whole PRD; add depth only where the
-     work demands it. The scaffold must not mint ceremony.
-     Conventions SSOT: docs/reference/sdlc-conventions.md (installed: $OPENRIG_HOME/reference/sdlc-conventions.md) -->
-
-# Slice 06 — S3 — Delivery Honesty End-to-End
-
-## Intent
-
-[The recorded intent, verbatim — kept in sync with the slice README.]
-
-## Mini-requirements
-
-1. [The concise one-glance requirement tier — this is where approval starts.]
-
-## Proof contract
-
-[MIRRORED 2026-08-26 by the workspace author (dev-planner, desk hygiene row 2ff03ab2), per
-the standing mirror rule (slice-06/0.5.3 precedent): SPEC.md is CANONICAL; the proof-pairing
-tool reads THIS file's exact `## Proof contract` section, so the SPEC promises are mirrored
-ITEM-EXACT below — this banner is the only permitted delta. Divergence in the items is a
-defect — fix it, never pick a winner silently.]
-
-- [ ] STAGED-UNSENT DETECTED BY EFFECT: a send whose text lands AT the prompt (staged, not
-      consumed) is reported as such by `send --verify` — RED-first against the current bytes
-      (today "sent" is reported), GREEN after, with the discriminating evidence being pane
-      effect, not a transport return.
-- [ ] CONSUMED MEANS CONSUMED: a genuinely consumed send verifies positively; the two
-      outcomes are never interchangeable and the staged report names what was checked.
-- [ ] NO DOUBLE DELIVERY: the staged remedy is the submit path (the single Enter), proven to
-      deliver exactly once; a blind re-send is never the product's suggestion.
-- [ ] INTERIM LORE RETIRED: the seat-discipline note ("staged-at-prompt, fix is one Enter")
-      is demonstrated unnecessary by the product's own report; retirement recorded in the
-      guidance that taught it, cited by path.
-
-## Notes (elastic)
-
-[Design, seams, risks, sequencing — only as much as the slice needs.]

.evidence/RED-cli-at-base-5c34da73c.txt

@@ -1,130 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s2-base-red/packages/cli
-
- ❯ test/broadcast.test.ts (9 tests | 1 failed) 116ms
-   × Broadcast CLI > broadcast renderer surfaces the unknown-sender notice from the response warning 53ms
-     → expected 'dev-impl@warn-rig: sent\ndev-qa@warn-…' to contain 'Advisory:'
-   ✓ Broadcast CLI > broadcast --rig prints per-target summary 14ms
-   ✓ Broadcast CLI > broadcast without --rig/--pod sends globally 4ms
-   ✓ Broadcast CLI > broadcast --context resolves a ref and fans out the whole content 29ms
-   ✓ Broadcast CLI > broadcast --context ABORTS (no fan-out) when the pack has a missing member 3ms
-   ✓ Broadcast CLI > P21: cross-host broadcast CARRIES the enveloped marker (was dropped → remote rendered raw); value = the seat, but the daemon derives the From: from the auto-stamped X-OpenRig-Session 1ms
-   ✓ Broadcast CLI > P18: an env-less cross-host broadcast DELIVERS with the honest `<unknown sender>` marker on the wire 0ms
-   ✓ Broadcast CLI > broadcast --json prints raw JSON 2ms
-   ✓ Broadcast CLI > broadcast exits nonzero when no targets resolve 6ms
-remote okstderr | test/send.test.ts > Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped)
-Warning: RIGGED_URL is deprecated; use OPENRIG_URL instead.
-
- ❯ test/send.test.ts (59 tests | 1 failed) 585ms
-   ✓ Send CLI > send prints success output 25ms
-   ✓ Send CLI > P18: an env-less send DELIVERS with an honest `<unknown sender>` label — dispatched, actorSession null 13ms
-   ✓ Send CLI > P18: a resolvable seat SENDS with its attributed identity — actorSession derived from the seat env, never forged 46ms
-   ✓ Send CLI > P18 canonicity: '<unknown sender>' is DEFINED at EXACTLY the two named twin sites — a third fails BY NAME 296ms
-   ✓ Send CLI > send with 409 mid-work prints error and exits non-zero 3ms
-   ✓ Send CLI > prints the Advisory on an unknown-proceed send (human output) 2ms
-   ✓ Send CLI > carries the advisory as `warning` in --json output 1ms
-   ✓ Send CLI > verify confirmed prints Delivery: delivered AND the legacy Verified: yes 1ms
-   ✓ Send CLI > verify redraw-race prints Delivery: rendered-unconfirmed (landed, with capture guidance) AND legacy Verified: no 1ms
-   ✓ Send CLI > verify genuine transport failure stays an error path, distinct from the middle (discriminator) 9ms
-   ✓ Send CLI > verify --json passes the additive outcome field through 2ms
-   ✓ Send CLI > send --json prints raw JSON 3ms
-   ✓ Send CLI > send --wait-for-idle posts waitForIdleMs and extends request timeout 3ms
-   ✓ Send CLI > send without wait-for-idle uses default client timeout path 0ms
-   ✓ Send CLI > send --context resolves a ref to its whole content and sends it (single-seat local) 1ms
-   ✓ Send CLI > send --context ABORTS (no send) when the pack has a missing/unreadable member 0ms
-   ✓ Send CLI > send rejects invalid wait-for-idle values before contacting daemon 0ms
-   ✓ Send CLI > send rejects wait-for-idle with force before contacting daemon 0ms
-   ✓ Send CLI > send --raw posts the exact text without the From/To envelope 1ms
-   ✓ Send CLI > default send (no --raw) wraps the From/To messaging envelope 1ms
-   ✓ Send CLI > send --from <origin> is IGNORED — From:/actor derive from the ambient transport identity, not --from 1ms
-   ✓ Send CLI > send --dangerously-interact --reason posts the override fields with raw (exact) text 1ms
-   ✓ Send CLI > send --dangerously-interact without --reason is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --dangerously-interact + --wait-for-idle is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --host forwards --raw/--dangerously-interact/--reason in the reconstructed remote argv 5ms
-   ✓ Send CLI > send --context rejects the agent@rig@host sugar cross-host form (NO message) — never reaches remote argv 1ms
-   ✓ Send CLI > send --context rejects the sugar cross-host form (WITH message) — context not silently dropped 0ms
-   ✓ Send CLI > send --to a,b fans out to /broadcast with a sessions list and prints per-recipient summary 17ms
-   ✓ Send CLI > send --to accepts repetition (--to a --to b) and sets the daemon-side envelopeSender 16ms
-   ✓ Send CLI > send --pod posts a pod target to /broadcast 1ms
-   ✓ Send CLI > send --rig posts a rig target to /broadcast 1ms
-   ✓ Send CLI > fan-out with one recipient failing prints which failed, the summary, and exits nonzero 1ms
-   × Send CLI > fan-out renderer surfaces the unknown-sender notice from the response warning 8ms
-     → expected 'dev-impl@my-rig: sent\ndev-qa@my-rig:…' to contain 'Advisory:'
-   ✓ Send CLI > fan-out --raw sends bare exact text with NO envelopeSender (no per-recipient wrap) 99ms
-   ✓ Send CLI > fan-out --dangerously-interact --reason plumbs the danger fields (bare text, no envelope) 1ms
-   ✓ Send CLI > rejects combining a bare seat with a fan-out flag 0ms
-   ✓ Send CLI > rejects more than one fan-out mode at once 0ms
-   ✓ Send CLI > rejects --wait-for-idle with a multi/pod/rig target 0ms
-   ✓ Send CLI > single-seat send is UNCHANGED — still posts to /send, byte-identical envelope, no /broadcast 1ms
-   ✓ Send CLI > send --help includes rediscovery examples + the new guard flags 1ms
-   ✓ Send CLI > send --help documents proceed-with-advisory on unknown telemetry, not fail-closed 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R1 RED: single-seat + OPENRIG_URL custom port + probe-stopped -> actual POST lands, exact env target passed to clientFactory 4ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R2 RED: fan-out --to + OPENRIG_URL + probe-stopped -> actual /broadcast lands with per-recipient results 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R4 RED: precedence — OPENRIG_URL wins over RIGGED_URL on the transport-authoritative path 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R5 RED: RUNNING-but-UNHEALTHY (event-loop-starved healthz body) must still send (single-seat + fan-out) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6 RED: NO env + live-pid state file (custom port) + healthz probe failing -> POST attempted against the state-derived target 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6b RED: NO env + NO daemon state + probe-stopped -> POST attempted against the configured DEFAULT target (injected client succeeds) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6c RED: NO env + NO state + probe-stopped + ConfigStore CUSTOM daemon host/port -> POST attempted against the CONFIGURED-FILE target exactly (no hardcoded default) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7 RED: REAL down fails honestly — actual connection error names the target; the bare preflight restart line never appears 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7b RED: fan-out REAL down fails honestly too — target-specific connection error, exit 1, no restart line, and the same remediation as single-seat 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7c RED: single-seat --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7d RED: fan-out --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7e: single-seat HUMAN transport failure keeps stdout empty (mirror of R7c) — the 3 remediation lines are stderr-only, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7f: fan-out HUMAN transport failure keeps stdout empty (mirror of R7d) — stderr-only remediation, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8: explicit OPENRIG_URL (single-seat) -> exact target POSTed + EXACTLY ONE self-id /healthz GET, no status-probe burn 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8b RED: explicit OPENRIG_URL (fan-out) -> exact target broadcast and ZERO lifecycle probe calls 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > --from is IGNORED in fan-out — BOTH envelopeSender and actorSession name the ambient transport identity, never the forged --from origin 3ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > F2 GREEN-characterization: with NO --from, fan-out still falls back to ambient identity (the flag is additive, not a behavior change) 1ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 2 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/broadcast.test.ts > Broadcast CLI > broadcast renderer surfaces the unknown-sender notice from the response warning
-AssertionError: expected 'dev-impl@warn-rig: sent\ndev-qa@warn-…' to contain 'Advisory:'
-
-- Expected
-+ Received
-
-- Advisory:
-+ dev-impl@warn-rig: sent
-+ dev-qa@warn-rig: sent
-+ 2/2 delivered
-
- ❯ test/broadcast.test.ts:119:20
-    117|     const output = logs.join("\n");
-    118|     expect(output).toContain("dev-impl@warn-rig: sent");
-    119|     expect(output).toContain("Advisory:");
-       |                    ^
-    120|     expect(output).toMatch(/no way of knowing who sent/i);
-    121|     expect(output).toMatch(/sign/i);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/2]⎯
-
- FAIL  test/send.test.ts > Send CLI > fan-out renderer surfaces the unknown-sender notice from the response warning
-AssertionError: expected 'dev-impl@my-rig: sent\ndev-qa@my-rig:…' to contain 'Advisory:'
-
-- Expected
-+ Received
-
-- Advisory:
-+ dev-impl@my-rig: sent
-+ dev-qa@my-rig: sent
-+ 2/2 delivered
-
- ❯ test/send.test.ts:642:20
-    640|     const output = logs.join("\n");
-    641|     expect(output).toContain("dev-impl@my-rig: sent");
-    642|     expect(output).toContain("Advisory:");
-       |                    ^
-    643|     expect(output).toMatch(/no way of knowing who sent/i);
-    644|     expect(output).toMatch(/sign/i);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[2/2]⎯
-
-
- Test Files  2 failed (2)
-      Tests  2 failed | 66 passed (68)
-   Start at  06:39:38
-   Duration  1.48s (transform 412ms, setup 142ms, collect 1.06s, tests 700ms, environment 0ms, prepare 116ms)
-
-vitest exit: 1

.evidence/RED-daemon-at-base-5c34da73c.txt

@@ -1,177 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s2-base-red/packages/daemon
-
- ❯ test/transport-routes.test.ts (43 tests | 6 failed) 7529ms
-   ✓ transport routes > POST /send with valid session returns 200 with SendResult 243ms
-   ✓ transport routes > A3 — a DERIVED send auto-records exactly ONE outbox row (sender=derived actor, provenance=transport:v1) 212ms
-   ✓ transport routes > A3 — a cross-host send records the ORIGIN triple (the derived header), never the relay's seat 224ms
-   ✓ transport routes > A3 — a send whose body actor differs is DELIVERED, and the outbox row carries the HEADER identity 211ms
-   ✓ transport routes > L5 A3 — header TRIPLE + body PAIR delivers, and records the WIRE identity (not the body claim) 225ms
-   ✓ transport routes > L5 A3 — a body claim naming a DIFFERENT actor is SUPERSEDED, never trusted, and never refuses 214ms
-   ✓ transport routes > A3 — a header-LESS send (no derived actor) auto-records NO row (nothing to attribute; no fabricated sender) 211ms
-   ✓ transport routes > A3b — a broadcast auto-records N rows, one per RESOLVED recipient (sender=derived, provenance=transport:v1, destination=each session, never the TargetSpec)  418ms
-   ✓ transport routes > A3b — a PARTIAL fan-out records per-row delivery_state (delivered vs failed) — the truth one row could not express 215ms
-   ✓ transport routes > A3b — a broadcast whose body actor differs is DELIVERED, and every row carries the HEADER identity  446ms
-   ✓ transport routes > A3b — a header-LESS broadcast auto-records NO rows (no derived sender to attribute)  461ms
-   ✓ transport routes > POST /send with verify surfaces the outcome field in the JSON response (passthrough)  714ms
-   ✓ transport routes > POST /send verify failure stays HTTP-error-distinct from the middle outcome (discriminator) 220ms
-   ✓ transport routes > POST /send to a mid-work pane returns 200 and DELIVERS with a non-blocking advisory (OPR.0.4.3.28 fast-follow — mid_work downgraded) 210ms
-   ✓ transport routes > POST /send to an interactive prompt returns 409 target_needs_input (default, no override) 8ms
-   ✓ transport routes > POST /send rejects --dangerously-interact + --wait-for-idle with 400 8ms
-   ✓ transport routes > POST /send rejects --dangerously-interact without a reason with 400 8ms
-   ✓ transport routes > POST /send with waitForIdleMs waits for idle and returns activity evidence 10ms
-   ✓ transport routes > POST /send rejects force with waitForIdleMs before sending 8ms
-   ✓ transport routes > POST /send maps wait timeout to 409 without sending text 10ms
-   ✓ transport routes > POST /send with ambiguous session returns 409 8ms
-   ✓ transport routes > POST /send to external_cli target returns 409 with honest transport guidance 8ms
-   ✓ transport routes > POST /capture with rig targeting returns multi-session results 10ms
-   ✓ transport routes > POST /capture with rig targeting includes external_cli targets as explicit failures 9ms
-   ✓ transport routes > POST /capture for external_cli target returns 409 with honest transport guidance 11ms
-   ✓ transport routes > POST /broadcast without rig/pod broadcasts globally to all running sessions  414ms
-   ✓ transport routes > POST /broadcast with partial failure returns honest per-target outcomes 212ms
-   ✓ transport routes > POST /broadcast with a sessions list renders the FULL recipient list on every To (anti-storm, B1)  412ms
-   ✓ transport routes > POST /broadcast WITHOUT envelopeSender delivers raw text to all (rig broadcast unchanged)  414ms
-   ✓ transport routes > POST /broadcast with an unknown seat in the list rejects honestly, naming the seat 8ms
-   ✓ transport routes > POST /broadcast list: one recipient failing does NOT abort the others (independence) 210ms
-   ✓ transport routes > POST /broadcast list keeps per-recipient send guard semantics for unknown telemetry and picker refusal 212ms
-   ✓ transport routes > POST /broadcast plumbs danger/reason/actorSession to EACH recipient send (per-seat, not per-batch)  416ms
-   ✓ transport routes > POST /broadcast includes external_cli targets as explicit transport_unavailable failures 10ms
-   ✓ transport routes > P21 I4: the From: line derives from the transport header, IGNORING a forged body.envelopeSender (specimen-5 kill) 210ms
-   × transport routes > P21 I4 → S2: an enveloped send with NO authenticated identity DELIVERS as unknown (still never renders an unverified From:) 15ms
-     → expected 401 to be 200 // Object.is equality
-   × transport routes > P21 I4 → S2: --dangerously-interact with NO identity delivers; a non-needs_input target writes NO override audit row 9ms
-     → expected 401 to be 200 // Object.is equality
-   ✓ transport routes > P21 I4: a body actorSession that DIFFERS from the header is SUPERSEDED (no identity_mismatch refusal) 210ms
-   × transport routes > S2 — unknown-sender honesty (OPR.0.5.4.3) > PROOF-1: enveloped broadcast with no header DELIVERS, From: is the unknown marker, hostile body claim never renders, notice in payload 8ms
-     → expected 401 to be 200 // Object.is equality
-   × transport routes > S2 — unknown-sender honesty (OPR.0.5.4.3) > PROOF-2: send --dangerously-interact with no header proceeds on a STAGED needs_input prompt; the audit row carries actorSession NULL 8ms
-     → expected 401 to be 200 // Object.is equality
-   × transport routes > S2 — unknown-sender honesty (OPR.0.5.4.3) > PROOF-2b: broadcast --dangerously-interact with no header proceeds; per-seat audit actorSession NULL 8ms
-     → expected 401 to be 200 // Object.is equality
-   × transport routes > S2 — unknown-sender honesty (OPR.0.5.4.3) > PROOF-4a: a plain unattributed send delivers BYTE-VERBATIM (no recipient-side marker) plus the response notice 212ms
-     → expected '' to match /sign/i
-   ✓ transport routes > S2 — unknown-sender honesty (OPR.0.5.4.3) > PROOF-4b: an attributed send's response carries no nag and delivers verbatim 216ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 6 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/transport-routes.test.ts > transport routes > P21 I4 → S2: an enveloped send with NO authenticated identity DELIVERS as unknown (still never renders an unverified From:)
-AssertionError: expected 401 to be 200 // Object.is equality
-
-- Expected
-+ Received
-
-- 200
-+ 401
-
- ❯ test/transport-routes.test.ts:870:24
-    868|     // S2 (OPR.0.5.4.3, founder descope): delivery replaces the refusa…
-    869|     // specimen-5 invariant is UNCHANGED — the body claim never render…
-    870|     expect(res.status).toBe(200);
-       |                        ^
-    871|     expect(delivered.some((t) => t.includes("From: <unknown sender>"))…
-    872|     expect(delivered.every((t) => !t.includes("anyone@my-rig"))).toBe(…
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/6]⎯
-
- FAIL  test/transport-routes.test.ts > transport routes > P21 I4 → S2: --dangerously-interact with NO identity delivers; a non-needs_input target writes NO override audit row
-AssertionError: expected 401 to be 200 // Object.is equality
-
-- Expected
-+ Received
-
-- 200
-+ 401
-
- ❯ test/transport-routes.test.ts:887:24
-    885|     // send path; the override audit exists only on the needs_input br…
-    886|     // no row is written here — unchanged posture, now unattributed-to…
-    887|     expect(res.status).toBe(200);
-       |                        ^
-    888|     const rows = db.prepare("SELECT * FROM events WHERE type = 'transp…
-    889|     expect(rows).toHaveLength(0);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[2/6]⎯
-
- FAIL  test/transport-routes.test.ts > transport routes > S2 — unknown-sender honesty (OPR.0.5.4.3) > PROOF-1: enveloped broadcast with no header DELIVERS, From: is the unknown marker, hostile body claim never renders, notice in payload
-AssertionError: expected 401 to be 200 // Object.is equality
-
-- Expected
-+ Received
-
-- 200
-+ 401
-
- ❯ test/transport-routes.test.ts:949:26
-    947|         body: JSON.stringify({ sessions: ["dev-impl@my-rig", "dev-qa@m…
-    948|       });
-    949|       expect(res.status).toBe(200); // RED at pre-fix bytes: 401 unatt…
-       |                          ^
-    950|       const data = (await res.json()) as Record<string, unknown>;
-    951|       expect(data["sent"]).toBe(2);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[3/6]⎯
-
- FAIL  test/transport-routes.test.ts > transport routes > S2 — unknown-sender honesty (OPR.0.5.4.3) > PROOF-2: send --dangerously-interact with no header proceeds on a STAGED needs_input prompt; the audit row carries actorSession NULL
-AssertionError: expected 401 to be 200 // Object.is equality
-
-- Expected
-+ Received
-
-- 200
-+ 401
-
- ❯ test/transport-routes.test.ts:979:26
-    977|         body: JSON.stringify({ session: "dev-impl@my-rig", text: "1", …
-    978|       });
-    979|       expect(res.status).toBe(200); // RED at pre-fix bytes: 401 unatt…
-       |                          ^
-    980|       const rows = overrideAuditRows();
-    981|       expect(rows).toHaveLength(1);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/6]⎯
-
- FAIL  test/transport-routes.test.ts > transport routes > S2 — unknown-sender honesty (OPR.0.5.4.3) > PROOF-2b: broadcast --dangerously-interact with no header proceeds; per-seat audit actorSession NULL
-AssertionError: expected 401 to be 200 // Object.is equality
-
-- Expected
-+ Received
-
-- 200
-+ 401
-
- ❯ test/transport-routes.test.ts:994:26
-    992|         body: JSON.stringify({ sessions: ["dev-impl@my-rig"], text: "1…
-    993|       });
-    994|       expect(res.status).toBe(200); // RED at pre-fix bytes: 401 unatt…
-       |                          ^
-    995|       const rows = overrideAuditRows();
-    996|       expect(rows).toHaveLength(1);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[5/6]⎯
-
- FAIL  test/transport-routes.test.ts > transport routes > S2 — unknown-sender honesty (OPR.0.5.4.3) > PROOF-4a: a plain unattributed send delivers BYTE-VERBATIM (no recipient-side marker) plus the response notice
-AssertionError: expected '' to match /sign/i
-
-- Expected: 
-/sign/i
-
-+ Received: 
-""
-
- ❯ test/transport-routes.test.ts:1011:45
-    1009|       expect(sentTexts[0]!.text).toBe("exact bytes ✓ --- é"); // raw s…
-    1010|       const data = (await res.json()) as Record<string, unknown>;
-    1011|       expect(String(data["warning"] ?? "")).toMatch(/sign/i); // RED a…
-       |                                             ^
-    1012|       expect(String(data["warning"] ?? "")).toMatch(/no way of knowing…
-    1013|     });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[6/6]⎯
-
-
- Test Files  1 failed (1)
-      Tests  6 failed | 37 passed (43)
-   Start at  06:39:27
-   Duration  9.82s (transform 1.22s, setup 0ms, collect 1.91s, tests 7.53s, environment 0ms, prepare 95ms)
-
-vitest exit: 1

.evidence/RED-fixround1-at-prefix-bytes.txt

@@ -1,213 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s3-delivery-honesty/packages/cli
-
-remote okstderr | test/send.test.ts > Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped)
-Warning: RIGGED_URL is deprecated; use OPENRIG_URL instead.
-
- ❯ test/send.test.ts (65 tests | 3 failed) 333ms
-   ✓ Send CLI > send prints success output 14ms
-   ✓ Send CLI > P18: an env-less send DELIVERS with an honest `<unknown sender>` label — dispatched, actorSession null 3ms
-   ✓ Send CLI > P18: a resolvable seat SENDS with its attributed identity — actorSession derived from the seat env, never forged 2ms
-   ✓ Send CLI > P18 canonicity: '<unknown sender>' is DEFINED at EXACTLY the two named twin sites — a third fails BY NAME 247ms
-   ✓ Send CLI > send with 409 mid-work prints error and exits non-zero 2ms
-   ✓ Send CLI > prints the Advisory on an unknown-proceed send (human output) 2ms
-   ✓ Send CLI > carries the advisory as `warning` in --json output 1ms
-   ✓ Send CLI > verify confirmed prints Delivery: delivered AND the legacy Verified: yes 2ms
-   ✓ Send CLI > verify redraw-race prints Delivery: rendered-unconfirmed (landed, with capture guidance) AND legacy Verified: no 3ms
-   ✓ Send CLI > verify genuine transport failure stays an error path, distinct from the middle (discriminator) 2ms
-   ✓ Send CLI > verify --json passes the additive outcome field through 1ms
-   ✓ Send CLI > send --json prints raw JSON 1ms
-   ✓ Send CLI > send --wait-for-idle posts waitForIdleMs and extends request timeout 1ms
-   ✓ Send CLI > send without wait-for-idle uses default client timeout path 1ms
-   ✓ Send CLI > send --context resolves a ref to its whole content and sends it (single-seat local) 1ms
-   ✓ Send CLI > send --context ABORTS (no send) when the pack has a missing/unreadable member 0ms
-   ✓ Send CLI > send rejects invalid wait-for-idle values before contacting daemon 0ms
-   ✓ Send CLI > send rejects wait-for-idle with force before contacting daemon 0ms
-   ✓ Send CLI > send --raw posts the exact text without the From/To envelope 1ms
-   ✓ Send CLI > default send (no --raw) wraps the From/To messaging envelope 1ms
-   ✓ Send CLI > send --from <origin> is IGNORED — From:/actor derive from the ambient transport identity, not --from 1ms
-   ✓ Send CLI > send --dangerously-interact --reason posts the override fields with raw (exact) text 1ms
-   ✓ Send CLI > send --dangerously-interact without --reason is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --dangerously-interact + --wait-for-idle is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --host forwards --raw/--dangerously-interact/--reason in the reconstructed remote argv 1ms
-   ✓ Send CLI > send --context rejects the agent@rig@host sugar cross-host form (NO message) — never reaches remote argv 0ms
-   ✓ Send CLI > send --context rejects the sugar cross-host form (WITH message) — context not silently dropped 0ms
-   ✓ Send CLI > send --to a,b fans out to /broadcast with a sessions list and prints per-recipient summary 1ms
-   ✓ Send CLI > send --to accepts repetition (--to a --to b) and sets the daemon-side envelopeSender 1ms
-   ✓ Send CLI > send --pod posts a pod target to /broadcast 1ms
-   ✓ Send CLI > send --rig posts a rig target to /broadcast 1ms
-   ✓ Send CLI > fan-out with one recipient failing prints which failed, the summary, and exits nonzero 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-1: a send whose text sits AT the prompt is reported STAGED — by pane effect, not the transport's verified:true 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-2: a genuinely consumed send verifies positively and is NEVER reported staged 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-3: the staged remedy is the single submit path — exactly one plain-text send, no blind re-send suggested or performed 2ms
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F3: a stale pasted-text placeholder in SCROLLBACK is NOT staged evidence — no staged report, no guarded submit fired 6ms
-     → expected 'Sent to stale-scroll-session\nVerifie…' not to match /staged/i
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: --json with --verify carries the effect classification in the envelope (staged case) 3ms
-     → expected undefined to be defined
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: fan-out with --verify reports per-recipient effect — staged named, consumed never claimed staged 3ms
-     → expected 0 to be greater than 0
-   ✓ Send CLI > fan-out renderer surfaces the unknown-sender notice from the response warning 1ms
-   ✓ Send CLI > fan-out --raw sends bare exact text with NO envelopeSender (no per-recipient wrap) 1ms
-   ✓ Send CLI > fan-out --dangerously-interact --reason plumbs the danger fields (bare text, no envelope) 1ms
-   ✓ Send CLI > rejects combining a bare seat with a fan-out flag 0ms
-   ✓ Send CLI > rejects more than one fan-out mode at once 0ms
-   ✓ Send CLI > rejects --wait-for-idle with a multi/pod/rig target 0ms
-   ✓ Send CLI > single-seat send is UNCHANGED — still posts to /send, byte-identical envelope, no /broadcast 1ms
-   ✓ Send CLI > send --help includes rediscovery examples + the new guard flags 1ms
-   ✓ Send CLI > send --help documents proceed-with-advisory on unknown telemetry, not fail-closed 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R1 RED: single-seat + OPENRIG_URL custom port + probe-stopped -> actual POST lands, exact env target passed to clientFactory 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R2 RED: fan-out --to + OPENRIG_URL + probe-stopped -> actual /broadcast lands with per-recipient results 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R4 RED: precedence — OPENRIG_URL wins over RIGGED_URL on the transport-authoritative path 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R5 RED: RUNNING-but-UNHEALTHY (event-loop-starved healthz body) must still send (single-seat + fan-out) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6 RED: NO env + live-pid state file (custom port) + healthz probe failing -> POST attempted against the state-derived target 4ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6b RED: NO env + NO daemon state + probe-stopped -> POST attempted against the configured DEFAULT target (injected client succeeds) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6c RED: NO env + NO state + probe-stopped + ConfigStore CUSTOM daemon host/port -> POST attempted against the CONFIGURED-FILE target exactly (no hardcoded default) 3ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7 RED: REAL down fails honestly — actual connection error names the target; the bare preflight restart line never appears 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7b RED: fan-out REAL down fails honestly too — target-specific connection error, exit 1, no restart line, and the same remediation as single-seat 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7c RED: single-seat --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7d RED: fan-out --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7e: single-seat HUMAN transport failure keeps stdout empty (mirror of R7c) — the 3 remediation lines are stderr-only, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7f: fan-out HUMAN transport failure keeps stdout empty (mirror of R7d) — stderr-only remediation, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8: explicit OPENRIG_URL (single-seat) -> exact target POSTed + EXACTLY ONE self-id /healthz GET, no status-probe burn 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8b RED: explicit OPENRIG_URL (fan-out) -> exact target broadcast and ZERO lifecycle probe calls 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > --from is IGNORED in fan-out — BOTH envelopeSender and actorSession name the ambient transport identity, never the forged --from origin 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > F2 GREEN-characterization: with NO --from, fan-out still falls back to ambient identity (the flag is additive, not a behavior change) 1ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 3 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F3: a stale pasted-text placeholder in SCROLLBACK is NOT staged evidence — no staged report, no guarded submit fired
-AssertionError: expected 'Sent to stale-scroll-session\nVerifie…' not to match /staged/i
-
-- Expected: 
-/staged/i
-
-+ Received: 
-"Sent to stale-scroll-session
-Verified: no
-Delivery: staged, not consumed (checked: post-send pane capture; observed: the sent text is still at the prompt — typed, never submitted)
-Remedy: one guarded Enter submitted, but the text is STILL at the prompt — not consumed; stopping here (one submit is the contract). Inspect with: rig capture stale-scroll-session"
-
- ❯ test/send.test.ts:714:26
-    712|       });
-    713|       const output = logs.join("\n");
-    714|       expect(output).not.toMatch(/staged/i);
-       |                          ^
-    715|       // and the submit path must never fire on history
-    716|       expect(sendBodies.filter((b) => b["submitOnly"])).toHaveLength(0…
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/3]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: --json with --verify carries the effect classification in the envelope (staged case)
-AssertionError: expected undefined to be defined
- ❯ test/send.test.ts:726:22
-    724|       const envelope = JSON.parse(logs.find((l) => l.trim().startsWith…
-    725|       const effect = envelope["effectCheck"] as Record<string, unknown…
-    726|       expect(effect).toBeDefined();
-       |                      ^
-    727|       expect(effect!["state"]).toBe("staged");
-    728|       expect(exitCode).toBe(1); // staged-not-cleared is not a silent …
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[2/3]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: fan-out with --verify reports per-recipient effect — staged named, consumed never claimed staged
-AssertionError: expected 0 to be greater than 0
- ❯ test/send.test.ts:741:40
-    739|       const lines = logs.join("\n").split("\n");
-    740|       const stagedEffectLines = lines.filter((l) => l.includes("staged…
-    741|       expect(stagedEffectLines.length).toBeGreaterThan(0); // RED pre-…
-       |                                        ^
-    742|       const consumedEffectClaims = lines.filter((l) => l.includes("con…
-    743|       expect(consumedEffectClaims).toHaveLength(0);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[3/3]⎯
-
-
- Test Files  1 failed (1)
-      Tests  3 failed | 62 passed (65)
-   Start at  07:34:31
-   Duration  861ms (transform 172ms, setup 44ms, collect 214ms, tests 333ms, environment 0ms, prepare 88ms)
-
-vitest exit: 1
-
- RUN  v3.2.4 /private/tmp/s3-delivery-honesty/packages/cli
-
-remote pane
- ❯ test/cross-host-http.test.ts (44 tests | 1 failed) 37527ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > plain 2-part target: untouched, no sugar, no hint, registry never loaded 1ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > 3-part with REGISTERED suffix: host-qualified — target stripped, host extracted 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > 3-part with UNREGISTERED suffix: passes through UNCHANGED with the loud hint 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > registry load failure: passthrough + hint (a plain-target failure mode is never added) 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > --host X + sugar @Y, X≠Y: structured conflict 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > --host X + sugar @X (same host twice): fine 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > adopted/raw 4-part-ish names keep working: only the LAST @ segment is a host candidate 0ms
-   ✓ send --host (http branch) > http host: POSTs the LOCAL body shape (wrapped envelope) to /api/transport/send; ssh runner never invoked; BR-1: session stays 2-part  1622ms
-   × send --host (http branch) > http host + --verify: reports the effect check as UNCHECKED (transport-level verdict only), never a silent effect claim 1622ms
-     → expected '[via host=vps-b (http://vps-b:7433)]\…' to match /unchecked/i
-   ✓ send --host (http branch) > --raw skips the envelope: exact text passthrough  1635ms
-   ✓ send --host (http branch) > anonymous (URL-only) http host: POSTs with NO Authorization header; still succeeds  1633ms
-   ✓ send --host (http branch) > sugar target dev-impl@my-rig@vps-b routes http with the STRIPPED session  1623ms
-   ✓ send --host (http branch) > --host conflict with a DIFFERENT sugar host: structured error, zero remote calls  815ms
-   ✓ send --host (http branch) > persisted selection drives the http branch when no --host and no sugar  1618ms
-   ✓ send --host (http branch) > explicit --host beats the persisted selection  1618ms
-   ✓ send --host (http branch) > sugar beats the persisted selection  1620ms
-   ✓ send --host (http branch) > --verify prints the REMOTE verdict verbatim (remote-authoritative, never locally synthesized)  1614ms
-   ✓ send --host (http branch) > --verify with no remote verdict field prints Verified: no (no local invention)  1617ms
-   ✓ send --host (http branch) > remote advisory (unknown actorSession) surfaces as the non-blocking Advisory line  1654ms
-   ✓ send --host (http branch) > G8 auth seam: a 401 surfaces as the structured permission-gate step with the remote's own error text  1612ms
-   ✓ send --host (http branch) > network failure surfaces as remote-daemon-unreachable, host named, never a hang  1616ms
-   ✓ send --host (http branch) > --wait-for-idle sizes the http deadline: waitForIdleMs + overhead  1623ms
-   ✓ send --host (http branch) > fan-out×host guard kept verbatim: --host + --rig rejected before any call 0ms
-   ✓ send --host (http branch) > unknown --host: structured unknown-host with the sugar hint appended when the target was 3-part-shaped  810ms
-   ✓ send --host (http branch) > json envelope: cross_host {host, target, transport:http} + the raw result  1614ms
-   ✓ capture --host (http branch) > http host: POSTs the LOCAL body shape to /api/transport/capture and renders the single result under the banner  806ms
-   ✓ capture --host (http branch) > anonymous (URL-only) http host: capture POSTs with NO Authorization header; still succeeds  817ms
-   ✓ capture --host (http branch) > multi-target (--rig/--pod) rides the http branch with per-target rendering  927ms
-   ✓ capture --host (http branch) > sugar target routes http with the stripped session (BR-1)  845ms
-   ✓ capture --host (http branch) > ssh host still takes the ssh shell-out (branch selection) 2ms
-   ✓ transcript --host (net-new, CLI-direct GET) > tail: GETs the exact local route path against the remote and renders origin shape verbatim  810ms
-   ✓ transcript --host (net-new, CLI-direct GET) > grep: GETs the grep route and renders matches  811ms
-   ✓ transcript --host (net-new, CLI-direct GET) > ssh host: the structured transport-requirement error (http-only verb, never silent) 0ms
-   ✓ transcript --host (net-new, CLI-direct GET) > unknown host: the same unknown-host step class as the other verbs 0ms
-   ✓ transcript --host (net-new, CLI-direct GET) > selection-driven cross-host works for the net-new verb too  829ms
-   ✓ transcript --host (net-new, CLI-direct GET) > arch n2: the transcript read is UNGATED — it SUCCEEDS under the exact wrong-terminal-bearer scenario that permission-gates send  2466ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > http host: POSTs the LOCAL body verbatim; per-target results print verbatim; clean fan-out exits 0  813ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > partial fan-out: per-target honesty verbatim + NON-ZERO exit (never summarized clean)  810ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > names its OWN fan-out budget at the call site (not the read-class default)  811ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > the text positional is NEVER sugar-parsed: a message containing a@b@vps-b broadcasts locally intact when no host is set 0ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > ssh host: structured transport-requirement error (http-only verb) 0ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > selection-driven cross-host broadcast  807ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > PIN 1 (money) — broadcast --host stamps the ORIGIN triple on X-OpenRig-Session (remote renders the origin, not the destination) 3ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > PIN 5 (fail-open) — local selfHostId unavailable ⇒ 2-part header, broadcast still ships 0ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/cross-host-http.test.ts > send --host (http branch) > http host + --verify: reports the effect check as UNCHECKED (transport-level verdict only), never a silent effect claim
-AssertionError: expected '[via host=vps-b (http://vps-b:7433)]\…' to match /unchecked/i
-
-- Expected: 
-/unchecked/i
-
-+ Received: 
-"[via host=vps-b (http://vps-b:7433)]
-Sent to dev-impl@my-rig
-Verified: yes
-Delivery: delivered (message landed; render confirmed)"
-
- ❯ test/cross-host-http.test.ts:220:17
-    218|     const out = captured.stdoutLines.join("\n");
-    219|     expect(out).toContain("Verified: yes"); // the remote transport ve…
-    220|     expect(out).toMatch(/unchecked/i); // and honestly labeled as effe…
-       |                 ^
-    221|     expect(out).toMatch(/transport-level only|not verifiable from this…
-    222|   });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/1]⎯
-
-
- Test Files  1 failed (1)
-      Tests  1 failed | 43 passed (44)
-   Start at  07:34:32
-   Duration  37.93s (transform 150ms, setup 28ms, collect 194ms, tests 37.53s, environment 0ms, prepare 43ms)
-
-vitest exit(xhost): 1

.evidence/RED-fixround1-final-testset-at-base-aacbc3362.txt

@@ -1,200 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s3fix-base-red/packages/cli
-
-remote okstderr | test/send.test.ts > Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped)
-Warning: RIGGED_URL is deprecated; use OPENRIG_URL instead.
-
- ❯ test/send.test.ts (65 tests | 3 failed) 379ms
-   ✓ Send CLI > send prints success output 18ms
-   ✓ Send CLI > P18: an env-less send DELIVERS with an honest `<unknown sender>` label — dispatched, actorSession null 32ms
-   ✓ Send CLI > P18: a resolvable seat SENDS with its attributed identity — actorSession derived from the seat env, never forged 2ms
-   ✓ Send CLI > P18 canonicity: '<unknown sender>' is DEFINED at EXACTLY the two named twin sites — a third fails BY NAME 271ms
-   ✓ Send CLI > send with 409 mid-work prints error and exits non-zero 2ms
-   ✓ Send CLI > prints the Advisory on an unknown-proceed send (human output) 2ms
-   ✓ Send CLI > carries the advisory as `warning` in --json output 1ms
-   ✓ Send CLI > verify confirmed prints Delivery: delivered AND the legacy Verified: yes 2ms
-   ✓ Send CLI > verify redraw-race prints Delivery: rendered-unconfirmed (landed, with capture guidance) AND legacy Verified: no 3ms
-   ✓ Send CLI > verify genuine transport failure stays an error path, distinct from the middle (discriminator) 1ms
-   ✓ Send CLI > verify --json passes the additive outcome field through 1ms
-   ✓ Send CLI > send --json prints raw JSON 1ms
-   ✓ Send CLI > send --wait-for-idle posts waitForIdleMs and extends request timeout 1ms
-   ✓ Send CLI > send without wait-for-idle uses default client timeout path 0ms
-   ✓ Send CLI > send --context resolves a ref to its whole content and sends it (single-seat local) 1ms
-   ✓ Send CLI > send --context ABORTS (no send) when the pack has a missing/unreadable member 0ms
-   ✓ Send CLI > send rejects invalid wait-for-idle values before contacting daemon 0ms
-   ✓ Send CLI > send rejects wait-for-idle with force before contacting daemon 0ms
-   ✓ Send CLI > send --raw posts the exact text without the From/To envelope 1ms
-   ✓ Send CLI > default send (no --raw) wraps the From/To messaging envelope 1ms
-   ✓ Send CLI > send --from <origin> is IGNORED — From:/actor derive from the ambient transport identity, not --from 1ms
-   ✓ Send CLI > send --dangerously-interact --reason posts the override fields with raw (exact) text 1ms
-   ✓ Send CLI > send --dangerously-interact without --reason is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --dangerously-interact + --wait-for-idle is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --host forwards --raw/--dangerously-interact/--reason in the reconstructed remote argv 1ms
-   ✓ Send CLI > send --context rejects the agent@rig@host sugar cross-host form (NO message) — never reaches remote argv 1ms
-   ✓ Send CLI > send --context rejects the sugar cross-host form (WITH message) — context not silently dropped 0ms
-   ✓ Send CLI > send --to a,b fans out to /broadcast with a sessions list and prints per-recipient summary 1ms
-   ✓ Send CLI > send --to accepts repetition (--to a --to b) and sets the daemon-side envelopeSender 1ms
-   ✓ Send CLI > send --pod posts a pod target to /broadcast 1ms
-   ✓ Send CLI > send --rig posts a rig target to /broadcast 1ms
-   ✓ Send CLI > fan-out with one recipient failing prints which failed, the summary, and exits nonzero 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-1: a send whose text sits AT the prompt is reported STAGED — by pane effect, not the transport's verified:true 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-2: a genuinely consumed send verifies positively and is NEVER reported staged 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-3: the staged remedy is the single submit path — exactly one plain-text send, no blind re-send suggested or performed 1ms
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F3: a stale pasted-text placeholder in SCROLLBACK is NOT staged evidence — no staged report, no guarded submit fired 5ms
-     → expected 'Sent to stale-scroll-session\nVerifie…' not to match /staged/i
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: --json with --verify carries the effect classification in the envelope (staged case) 2ms
-     → expected undefined to be defined
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: fan-out with --verify reports per-recipient effect — staged named, consumed never claimed staged 1ms
-     → expected 0 to be greater than 0
-   ✓ Send CLI > fan-out renderer surfaces the unknown-sender notice from the response warning 1ms
-   ✓ Send CLI > fan-out --raw sends bare exact text with NO envelopeSender (no per-recipient wrap) 1ms
-   ✓ Send CLI > fan-out --dangerously-interact --reason plumbs the danger fields (bare text, no envelope) 1ms
-   ✓ Send CLI > rejects combining a bare seat with a fan-out flag 0ms
-   ✓ Send CLI > rejects more than one fan-out mode at once 0ms
-   ✓ Send CLI > rejects --wait-for-idle with a multi/pod/rig target 0ms
-   ✓ Send CLI > single-seat send is UNCHANGED — still posts to /send, byte-identical envelope, no /broadcast 1ms
-   ✓ Send CLI > send --help includes rediscovery examples + the new guard flags 1ms
-   ✓ Send CLI > send --help documents proceed-with-advisory on unknown telemetry, not fail-closed 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R1 RED: single-seat + OPENRIG_URL custom port + probe-stopped -> actual POST lands, exact env target passed to clientFactory 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R2 RED: fan-out --to + OPENRIG_URL + probe-stopped -> actual /broadcast lands with per-recipient results 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R4 RED: precedence — OPENRIG_URL wins over RIGGED_URL on the transport-authoritative path 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R5 RED: RUNNING-but-UNHEALTHY (event-loop-starved healthz body) must still send (single-seat + fan-out) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6 RED: NO env + live-pid state file (custom port) + healthz probe failing -> POST attempted against the state-derived target 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6b RED: NO env + NO daemon state + probe-stopped -> POST attempted against the configured DEFAULT target (injected client succeeds) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6c RED: NO env + NO state + probe-stopped + ConfigStore CUSTOM daemon host/port -> POST attempted against the CONFIGURED-FILE target exactly (no hardcoded default) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7 RED: REAL down fails honestly — actual connection error names the target; the bare preflight restart line never appears 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7b RED: fan-out REAL down fails honestly too — target-specific connection error, exit 1, no restart line, and the same remediation as single-seat 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7c RED: single-seat --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7d RED: fan-out --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7e: single-seat HUMAN transport failure keeps stdout empty (mirror of R7c) — the 3 remediation lines are stderr-only, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7f: fan-out HUMAN transport failure keeps stdout empty (mirror of R7d) — stderr-only remediation, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8: explicit OPENRIG_URL (single-seat) -> exact target POSTed + EXACTLY ONE self-id /healthz GET, no status-probe burn 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8b RED: explicit OPENRIG_URL (fan-out) -> exact target broadcast and ZERO lifecycle probe calls 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > --from is IGNORED in fan-out — BOTH envelopeSender and actorSession name the ambient transport identity, never the forged --from origin 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > F2 GREEN-characterization: with NO --from, fan-out still falls back to ambient identity (the flag is additive, not a behavior change) 1ms
-remote pane
- ❯ test/cross-host-http.test.ts (44 tests | 1 failed) 37427ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > plain 2-part target: untouched, no sugar, no hint, registry never loaded 1ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > 3-part with REGISTERED suffix: host-qualified — target stripped, host extracted 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > 3-part with UNREGISTERED suffix: passes through UNCHANGED with the loud hint 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > registry load failure: passthrough + hint (a plain-target failure mode is never added) 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > --host X + sugar @Y, X≠Y: structured conflict 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > --host X + sugar @X (same host twice): fine 0ms
-   ✓ resolveCrossHostTarget (§4 sugar + precedence) > adopted/raw 4-part-ish names keep working: only the LAST @ segment is a host candidate 0ms
-   ✓ send --host (http branch) > http host: POSTs the LOCAL body shape (wrapped envelope) to /api/transport/send; ssh runner never invoked; BR-1: session stays 2-part  1649ms
-   × send --host (http branch) > http host + --verify: reports the effect check as UNCHECKED (transport-level verdict only), never a silent effect claim 1624ms
-     → expected '[via host=vps-b (http://vps-b:7433)]\…' to match /unchecked/i
-   ✓ send --host (http branch) > --raw skips the envelope: exact text passthrough  1625ms
-   ✓ send --host (http branch) > anonymous (URL-only) http host: POSTs with NO Authorization header; still succeeds  1616ms
-   ✓ send --host (http branch) > sugar target dev-impl@my-rig@vps-b routes http with the STRIPPED session  1619ms
-   ✓ send --host (http branch) > --host conflict with a DIFFERENT sugar host: structured error, zero remote calls  810ms
-   ✓ send --host (http branch) > persisted selection drives the http branch when no --host and no sugar  1621ms
-   ✓ send --host (http branch) > explicit --host beats the persisted selection  1641ms
-   ✓ send --host (http branch) > sugar beats the persisted selection  1640ms
-   ✓ send --host (http branch) > --verify prints the REMOTE verdict verbatim (remote-authoritative, never locally synthesized)  1639ms
-   ✓ send --host (http branch) > --verify with no remote verdict field prints Verified: no (no local invention)  1616ms
-   ✓ send --host (http branch) > remote advisory (unknown actorSession) surfaces as the non-blocking Advisory line  1618ms
-   ✓ send --host (http branch) > G8 auth seam: a 401 surfaces as the structured permission-gate step with the remote's own error text  1625ms
-   ✓ send --host (http branch) > network failure surfaces as remote-daemon-unreachable, host named, never a hang  1623ms
-   ✓ send --host (http branch) > --wait-for-idle sizes the http deadline: waitForIdleMs + overhead  1635ms
-   ✓ send --host (http branch) > fan-out×host guard kept verbatim: --host + --rig rejected before any call 0ms
-   ✓ send --host (http branch) > unknown --host: structured unknown-host with the sugar hint appended when the target was 3-part-shaped  811ms
-   ✓ send --host (http branch) > json envelope: cross_host {host, target, transport:http} + the raw result  1613ms
-   ✓ capture --host (http branch) > http host: POSTs the LOCAL body shape to /api/transport/capture and renders the single result under the banner  811ms
-   ✓ capture --host (http branch) > anonymous (URL-only) http host: capture POSTs with NO Authorization header; still succeeds  811ms
-   ✓ capture --host (http branch) > multi-target (--rig/--pod) rides the http branch with per-target rendering  811ms
-   ✓ capture --host (http branch) > sugar target routes http with the stripped session (BR-1)  822ms
-   ✓ capture --host (http branch) > ssh host still takes the ssh shell-out (branch selection) 1ms
-   ✓ transcript --host (net-new, CLI-direct GET) > tail: GETs the exact local route path against the remote and renders origin shape verbatim  809ms
-   ✓ transcript --host (net-new, CLI-direct GET) > grep: GETs the grep route and renders matches  812ms
-   ✓ transcript --host (net-new, CLI-direct GET) > ssh host: the structured transport-requirement error (http-only verb, never silent) 0ms
-   ✓ transcript --host (net-new, CLI-direct GET) > unknown host: the same unknown-host step class as the other verbs 0ms
-   ✓ transcript --host (net-new, CLI-direct GET) > selection-driven cross-host works for the net-new verb too  812ms
-   ✓ transcript --host (net-new, CLI-direct GET) > arch n2: the transcript read is UNGATED — it SUCCEEDS under the exact wrong-terminal-bearer scenario that permission-gates send  2439ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > http host: POSTs the LOCAL body verbatim; per-target results print verbatim; clean fan-out exits 0  812ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > partial fan-out: per-target honesty verbatim + NON-ZERO exit (never summarized clean)  809ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > names its OWN fan-out budget at the call site (not the read-class default)  809ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > the text positional is NEVER sugar-parsed: a message containing a@b@vps-b broadcasts locally intact when no host is set 0ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > ssh host: structured transport-requirement error (http-only verb) 0ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > selection-driven cross-host broadcast  815ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > PIN 1 (money) — broadcast --host stamps the ORIGIN triple on X-OpenRig-Session (remote renders the origin, not the destination) 22ms
-   ✓ broadcast --host (net-new, CLI-direct POST) > PIN 5 (fail-open) — local selfHostId unavailable ⇒ 2-part header, broadcast still ships 1ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 4 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/cross-host-http.test.ts > send --host (http branch) > http host + --verify: reports the effect check as UNCHECKED (transport-level verdict only), never a silent effect claim
-AssertionError: expected '[via host=vps-b (http://vps-b:7433)]\…' to match /unchecked/i
-
-- Expected: 
-/unchecked/i
-
-+ Received: 
-"[via host=vps-b (http://vps-b:7433)]
-Sent to dev-impl@my-rig
-Verified: yes
-Delivery: delivered (message landed; render confirmed)"
-
- ❯ test/cross-host-http.test.ts:220:17
-    218|     const out = captured.stdoutLines.join("\n");
-    219|     expect(out).toContain("Verified: yes"); // the remote transport ve…
-    220|     expect(out).toMatch(/unchecked/i); // and honestly labeled as effe…
-       |                 ^
-    221|     expect(out).toMatch(/transport-level only|not verifiable from this…
-    222|   });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/4]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F3: a stale pasted-text placeholder in SCROLLBACK is NOT staged evidence — no staged report, no guarded submit fired
-AssertionError: expected 'Sent to stale-scroll-session\nVerifie…' not to match /staged/i
-
-- Expected: 
-/staged/i
-
-+ Received: 
-"Sent to stale-scroll-session
-Verified: no
-Delivery: staged, not consumed (checked: post-send pane capture; observed: the sent text is still at the prompt — typed, never submitted)
-Remedy: one guarded Enter submitted, but the text is STILL at the prompt — not consumed; stopping here (one submit is the contract). Inspect with: rig capture stale-scroll-session"
-
- ❯ test/send.test.ts:714:26
-    712|       });
-    713|       const output = logs.join("\n");
-    714|       expect(output).not.toMatch(/staged/i);
-       |                          ^
-    715|       // and the submit path must never fire on history
-    716|       expect(sendBodies.filter((b) => b["submitOnly"])).toHaveLength(0…
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[2/4]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: --json with --verify carries the effect classification in the envelope (staged case)
-AssertionError: expected undefined to be defined
- ❯ test/send.test.ts:726:22
-    724|       const envelope = JSON.parse(logs.find((l) => l.trim().startsWith…
-    725|       const effect = envelope["effectCheck"] as Record<string, unknown…
-    726|       expect(effect).toBeDefined();
-       |                      ^
-    727|       expect(effect!["state"]).toBe("staged");
-    728|       expect(exitCode).toBe(1); // staged-not-cleared is not a silent …
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[3/4]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: fan-out with --verify reports per-recipient effect — staged named, consumed never claimed staged
-AssertionError: expected 0 to be greater than 0
- ❯ test/send.test.ts:741:40
-    739|       const lines = logs.join("\n").split("\n");
-    740|       const stagedEffectLines = lines.filter((l) => l.includes("staged…
-    741|       expect(stagedEffectLines.length).toBeGreaterThan(0); // RED pre-…
-       |                                        ^
-    742|       const consumedEffectClaims = lines.filter((l) => l.includes("con…
-    743|       expect(consumedEffectClaims).toHaveLength(0);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/4]⎯
-
-
- Test Files  2 failed (2)
-      Tests  4 failed | 105 passed (109)
-   Start at  07:39:43
-   Duration  37.79s (transform 172ms, setup 59ms, collect 367ms, tests 37.81s, environment 0ms, prepare 76ms)
-
-vitest exit: 1

.evidence/RED-fixround2-at-c6263a47a.txt

@@ -1,162 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s3-delivery-honesty/packages/cli
-
-remote okstderr | test/send.test.ts > Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped)
-Warning: RIGGED_URL is deprecated; use OPENRIG_URL instead.
-
- ❯ test/send.test.ts (69 tests | 4 failed) 312ms
-   ✓ Send CLI > send prints success output 13ms
-   ✓ Send CLI > P18: an env-less send DELIVERS with an honest `<unknown sender>` label — dispatched, actorSession null 3ms
-   ✓ Send CLI > P18: a resolvable seat SENDS with its attributed identity — actorSession derived from the seat env, never forged 2ms
-   ✓ Send CLI > P18 canonicity: '<unknown sender>' is DEFINED at EXACTLY the two named twin sites — a third fails BY NAME 211ms
-   ✓ Send CLI > send with 409 mid-work prints error and exits non-zero 2ms
-   ✓ Send CLI > prints the Advisory on an unknown-proceed send (human output) 2ms
-   ✓ Send CLI > carries the advisory as `warning` in --json output 2ms
-   ✓ Send CLI > verify confirmed prints Delivery: delivered AND the legacy Verified: yes 2ms
-   ✓ Send CLI > verify redraw-race prints Delivery: rendered-unconfirmed (landed, with capture guidance) AND legacy Verified: no 3ms
-   ✓ Send CLI > verify genuine transport failure stays an error path, distinct from the middle (discriminator) 1ms
-   ✓ Send CLI > verify --json passes the additive outcome field through 1ms
-   ✓ Send CLI > send --json prints raw JSON 1ms
-   ✓ Send CLI > send --wait-for-idle posts waitForIdleMs and extends request timeout 1ms
-   ✓ Send CLI > send without wait-for-idle uses default client timeout path 0ms
-   ✓ Send CLI > send --context resolves a ref to its whole content and sends it (single-seat local) 1ms
-   ✓ Send CLI > send --context ABORTS (no send) when the pack has a missing/unreadable member 0ms
-   ✓ Send CLI > send rejects invalid wait-for-idle values before contacting daemon 0ms
-   ✓ Send CLI > send rejects wait-for-idle with force before contacting daemon 0ms
-   ✓ Send CLI > send --raw posts the exact text without the From/To envelope 1ms
-   ✓ Send CLI > default send (no --raw) wraps the From/To messaging envelope 1ms
-   ✓ Send CLI > send --from <origin> is IGNORED — From:/actor derive from the ambient transport identity, not --from 2ms
-   ✓ Send CLI > send --dangerously-interact --reason posts the override fields with raw (exact) text 2ms
-   ✓ Send CLI > send --dangerously-interact without --reason is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --dangerously-interact + --wait-for-idle is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --host forwards --raw/--dangerously-interact/--reason in the reconstructed remote argv 1ms
-   ✓ Send CLI > send --context rejects the agent@rig@host sugar cross-host form (NO message) — never reaches remote argv 0ms
-   ✓ Send CLI > send --context rejects the sugar cross-host form (WITH message) — context not silently dropped 0ms
-   ✓ Send CLI > send --to a,b fans out to /broadcast with a sessions list and prints per-recipient summary 2ms
-   ✓ Send CLI > send --to accepts repetition (--to a --to b) and sets the daemon-side envelopeSender 7ms
-   ✓ Send CLI > send --pod posts a pod target to /broadcast 2ms
-   ✓ Send CLI > send --rig posts a rig target to /broadcast 1ms
-   ✓ Send CLI > fan-out with one recipient failing prints which failed, the summary, and exits nonzero 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-1: a send whose text sits AT the prompt is reported STAGED — by pane effect, not the transport's verified:true 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-2: a genuinely consumed send verifies positively and is NEVER reported staged 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-3: the staged remedy is the single submit path — exactly one plain-text send, no blind re-send suggested or performed 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F3: a stale pasted-text placeholder in SCROLLBACK is NOT staged evidence — no staged report, no guarded submit fired 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: --json with --verify carries the effect classification in the envelope (staged case) 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: fan-out with --verify reports per-recipient effect — staged named, consumed never claimed staged 3ms
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 human: a staged-unresolved recipient gets NO sent line and is NOT counted delivered — one verdict only 6ms
-     → expected true to be false // Object.is equality
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json: the same recipient can never be simultaneously delivered and staged-not-consumed in the envelope 2ms
-     → expected true to be false // Object.is equality
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json single-send: a staged-unresolved envelope carries no delivered claim beside the staged effect 2ms
-     → expected true not to be true // Object.is equality
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F2: an unrelated size-mismatched placeholder is UNVERIFIABLE — never staged-as-this-send, never a guarded submit 2ms
-     → expected 'Sent to unrelated-paste-session\nVeri…' not to match /staged, not consumed/i
-   ✓ Send CLI > fan-out renderer surfaces the unknown-sender notice from the response warning 1ms
-   ✓ Send CLI > fan-out --raw sends bare exact text with NO envelopeSender (no per-recipient wrap) 1ms
-   ✓ Send CLI > fan-out --dangerously-interact --reason plumbs the danger fields (bare text, no envelope) 1ms
-   ✓ Send CLI > rejects combining a bare seat with a fan-out flag 0ms
-   ✓ Send CLI > rejects more than one fan-out mode at once 0ms
-   ✓ Send CLI > rejects --wait-for-idle with a multi/pod/rig target 0ms
-   ✓ Send CLI > single-seat send is UNCHANGED — still posts to /send, byte-identical envelope, no /broadcast 3ms
-   ✓ Send CLI > send --help includes rediscovery examples + the new guard flags 1ms
-   ✓ Send CLI > send --help documents proceed-with-advisory on unknown telemetry, not fail-closed 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R1 RED: single-seat + OPENRIG_URL custom port + probe-stopped -> actual POST lands, exact env target passed to clientFactory 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R2 RED: fan-out --to + OPENRIG_URL + probe-stopped -> actual /broadcast lands with per-recipient results 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R4 RED: precedence — OPENRIG_URL wins over RIGGED_URL on the transport-authoritative path 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R5 RED: RUNNING-but-UNHEALTHY (event-loop-starved healthz body) must still send (single-seat + fan-out) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6 RED: NO env + live-pid state file (custom port) + healthz probe failing -> POST attempted against the state-derived target 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6b RED: NO env + NO daemon state + probe-stopped -> POST attempted against the configured DEFAULT target (injected client succeeds) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6c RED: NO env + NO state + probe-stopped + ConfigStore CUSTOM daemon host/port -> POST attempted against the CONFIGURED-FILE target exactly (no hardcoded default) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7 RED: REAL down fails honestly — actual connection error names the target; the bare preflight restart line never appears 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7b RED: fan-out REAL down fails honestly too — target-specific connection error, exit 1, no restart line, and the same remediation as single-seat 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7c RED: single-seat --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7d RED: fan-out --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7e: single-seat HUMAN transport failure keeps stdout empty (mirror of R7c) — the 3 remediation lines are stderr-only, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7f: fan-out HUMAN transport failure keeps stdout empty (mirror of R7d) — stderr-only remediation, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8: explicit OPENRIG_URL (single-seat) -> exact target POSTed + EXACTLY ONE self-id /healthz GET, no status-probe burn 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8b RED: explicit OPENRIG_URL (fan-out) -> exact target broadcast and ZERO lifecycle probe calls 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > --from is IGNORED in fan-out — BOTH envelopeSender and actorSession name the ambient transport identity, never the forged --from origin 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > F2 GREEN-characterization: with NO --from, fan-out still falls back to ambient identity (the flag is additive, not a behavior change) 0ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 4 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 human: a staged-unresolved recipient gets NO sent line and is NOT counted delivered — one verdict only
-AssertionError: expected true to be false // Object.is equality
-
-- Expected
-+ Received
-
-- false
-+ true
-
- ❯ test/send.test.ts:758:68
-    756|       const lines = logs.join("\n").split("\n");
-    757|       // the false lines must be ABSENT (desk-binding): no unqualified…
-    758|       expect(lines.some((l) => /^staged-session: sent\b/.test(l))).toB…
-       |                                                                    ^
-    759|       expect(lines.join("\n")).toContain("1/2 delivered");
-    760|       expect(lines.join("\n")).not.toContain("2/2 delivered");
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/4]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json: the same recipient can never be simultaneously delivered and staged-not-consumed in the envelope
-AssertionError: expected true to be false // Object.is equality
-
-- Expected
-+ Received
-
-- false
-+ true
-
- ❯ test/send.test.ts:775:32
-    773|       expect(stagedRow).toBeDefined();
-    774|       // ONE verdict: the staged-unresolved row is not a delivery claim
-    775|       expect(stagedRow!["ok"]).toBe(false);
-       |                                ^
-    776|       expect(stagedRow!["outcome"]).toBe("staged-not-consumed");
-    777|       expect(stagedRow!["verified"]).not.toBe(true);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[2/4]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json single-send: a staged-unresolved envelope carries no delivered claim beside the staged effect
-AssertionError: expected true not to be true // Object.is equality
- ❯ test/send.test.ts:786:40
-    784|       const envelope = JSON.parse(logs.find((l) => l.trim().startsWith…
-    785|       expect((envelope["effectCheck"] as Record<string, unknown>)["sta…
-    786|       expect(envelope["verified"]).not.toBe(true);
-       |                                        ^
-    787|       expect(envelope["outcome"]).toBe("staged-not-consumed");
-    788|     });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[3/4]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F2: an unrelated size-mismatched placeholder is UNVERIFIABLE — never staged-as-this-send, never a guarded submit
-AssertionError: expected 'Sent to unrelated-paste-session\nVeri…' not to match /staged, not consumed/i
-
-- Expected: 
-/staged, not consumed/i
-
-+ Received: 
-"Sent to unrelated-paste-session
-Verified: no
-Delivery: staged, not consumed (checked: post-send pane capture; observed: the sent text is still at the prompt — typed, never submitted)
-Remedy: one guarded Enter submitted, but the text is STILL at the prompt — not consumed; stopping here (one submit is the contract). Inspect with: rig capture unrelated-paste-session"
-
- ❯ test/send.test.ts:795:26
-    793|       });
-    794|       const output = logs.join("\n");
-    795|       expect(output).not.toMatch(/staged, not consumed/i); // no stage…
-       |                          ^
-    796|       expect(sendBodies.filter((b) => b["submitOnly"])).toHaveLength(0…
-    797|       expect(output).toMatch(/unverifiable|not .{0,20}this send|does n…
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/4]⎯
-
-
- Test Files  1 failed (1)
-      Tests  4 failed | 65 passed (69)
-   Start at  07:58:12
-   Duration  822ms (transform 153ms, setup 30ms, collect 205ms, tests 312ms, environment 0ms, prepare 43ms)
-
-vitest exit: 1

.evidence/RED-fixround2-final-testset-at-base-c6263a47a.txt

@@ -1,162 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s3r2-base/packages/cli
-
-remote okstderr | test/send.test.ts > Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped)
-Warning: RIGGED_URL is deprecated; use OPENRIG_URL instead.
-
- ❯ test/send.test.ts (69 tests | 4 failed) 265ms
-   ✓ Send CLI > send prints success output 16ms
-   ✓ Send CLI > P18: an env-less send DELIVERS with an honest `<unknown sender>` label — dispatched, actorSession null 4ms
-   ✓ Send CLI > P18: a resolvable seat SENDS with its attributed identity — actorSession derived from the seat env, never forged 2ms
-   ✓ Send CLI > P18 canonicity: '<unknown sender>' is DEFINED at EXACTLY the two named twin sites — a third fails BY NAME 174ms
-   ✓ Send CLI > send with 409 mid-work prints error and exits non-zero 2ms
-   ✓ Send CLI > prints the Advisory on an unknown-proceed send (human output) 2ms
-   ✓ Send CLI > carries the advisory as `warning` in --json output 1ms
-   ✓ Send CLI > verify confirmed prints Delivery: delivered AND the legacy Verified: yes 2ms
-   ✓ Send CLI > verify redraw-race prints Delivery: rendered-unconfirmed (landed, with capture guidance) AND legacy Verified: no 3ms
-   ✓ Send CLI > verify genuine transport failure stays an error path, distinct from the middle (discriminator) 1ms
-   ✓ Send CLI > verify --json passes the additive outcome field through 1ms
-   ✓ Send CLI > send --json prints raw JSON 1ms
-   ✓ Send CLI > send --wait-for-idle posts waitForIdleMs and extends request timeout 1ms
-   ✓ Send CLI > send without wait-for-idle uses default client timeout path 0ms
-   ✓ Send CLI > send --context resolves a ref to its whole content and sends it (single-seat local) 1ms
-   ✓ Send CLI > send --context ABORTS (no send) when the pack has a missing/unreadable member 0ms
-   ✓ Send CLI > send rejects invalid wait-for-idle values before contacting daemon 0ms
-   ✓ Send CLI > send rejects wait-for-idle with force before contacting daemon 0ms
-   ✓ Send CLI > send --raw posts the exact text without the From/To envelope 1ms
-   ✓ Send CLI > default send (no --raw) wraps the From/To messaging envelope 1ms
-   ✓ Send CLI > send --from <origin> is IGNORED — From:/actor derive from the ambient transport identity, not --from 1ms
-   ✓ Send CLI > send --dangerously-interact --reason posts the override fields with raw (exact) text 1ms
-   ✓ Send CLI > send --dangerously-interact without --reason is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --dangerously-interact + --wait-for-idle is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --host forwards --raw/--dangerously-interact/--reason in the reconstructed remote argv 1ms
-   ✓ Send CLI > send --context rejects the agent@rig@host sugar cross-host form (NO message) — never reaches remote argv 0ms
-   ✓ Send CLI > send --context rejects the sugar cross-host form (WITH message) — context not silently dropped 0ms
-   ✓ Send CLI > send --to a,b fans out to /broadcast with a sessions list and prints per-recipient summary 1ms
-   ✓ Send CLI > send --to accepts repetition (--to a --to b) and sets the daemon-side envelopeSender 1ms
-   ✓ Send CLI > send --pod posts a pod target to /broadcast 1ms
-   ✓ Send CLI > send --rig posts a rig target to /broadcast 1ms
-   ✓ Send CLI > fan-out with one recipient failing prints which failed, the summary, and exits nonzero 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-1: a send whose text sits AT the prompt is reported STAGED — by pane effect, not the transport's verified:true 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-2: a genuinely consumed send verifies positively and is NEVER reported staged 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-3: the staged remedy is the single submit path — exactly one plain-text send, no blind re-send suggested or performed 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F3: a stale pasted-text placeholder in SCROLLBACK is NOT staged evidence — no staged report, no guarded submit fired 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: --json with --verify carries the effect classification in the envelope (staged case) 3ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: fan-out with --verify reports per-recipient effect — staged named, consumed never claimed staged 3ms
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 human: a staged-unresolved recipient gets NO sent line and is NOT counted delivered — one verdict only 6ms
-     → expected true to be false // Object.is equality
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json: the same recipient can never be simultaneously delivered and staged-not-consumed in the envelope 3ms
-     → expected true to be false // Object.is equality
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json single-send: a staged-unresolved envelope carries no delivered claim beside the staged effect 2ms
-     → expected true not to be true // Object.is equality
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F2: an unrelated size-mismatched placeholder is UNVERIFIABLE — never staged-as-this-send, never a guarded submit 2ms
-     → expected 'Sent to unrelated-paste-session\nVeri…' not to match /staged, not consumed/i
-   ✓ Send CLI > fan-out renderer surfaces the unknown-sender notice from the response warning 2ms
-   ✓ Send CLI > fan-out --raw sends bare exact text with NO envelopeSender (no per-recipient wrap) 1ms
-   ✓ Send CLI > fan-out --dangerously-interact --reason plumbs the danger fields (bare text, no envelope) 1ms
-   ✓ Send CLI > rejects combining a bare seat with a fan-out flag 0ms
-   ✓ Send CLI > rejects more than one fan-out mode at once 0ms
-   ✓ Send CLI > rejects --wait-for-idle with a multi/pod/rig target 0ms
-   ✓ Send CLI > single-seat send is UNCHANGED — still posts to /send, byte-identical envelope, no /broadcast 1ms
-   ✓ Send CLI > send --help includes rediscovery examples + the new guard flags 1ms
-   ✓ Send CLI > send --help documents proceed-with-advisory on unknown telemetry, not fail-closed 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R1 RED: single-seat + OPENRIG_URL custom port + probe-stopped -> actual POST lands, exact env target passed to clientFactory 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R2 RED: fan-out --to + OPENRIG_URL + probe-stopped -> actual /broadcast lands with per-recipient results 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R4 RED: precedence — OPENRIG_URL wins over RIGGED_URL on the transport-authoritative path 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R5 RED: RUNNING-but-UNHEALTHY (event-loop-starved healthz body) must still send (single-seat + fan-out) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6 RED: NO env + live-pid state file (custom port) + healthz probe failing -> POST attempted against the state-derived target 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6b RED: NO env + NO daemon state + probe-stopped -> POST attempted against the configured DEFAULT target (injected client succeeds) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6c RED: NO env + NO state + probe-stopped + ConfigStore CUSTOM daemon host/port -> POST attempted against the CONFIGURED-FILE target exactly (no hardcoded default) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7 RED: REAL down fails honestly — actual connection error names the target; the bare preflight restart line never appears 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7b RED: fan-out REAL down fails honestly too — target-specific connection error, exit 1, no restart line, and the same remediation as single-seat 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7c RED: single-seat --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7d RED: fan-out --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7e: single-seat HUMAN transport failure keeps stdout empty (mirror of R7c) — the 3 remediation lines are stderr-only, exit 1 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7f: fan-out HUMAN transport failure keeps stdout empty (mirror of R7d) — stderr-only remediation, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8: explicit OPENRIG_URL (single-seat) -> exact target POSTed + EXACTLY ONE self-id /healthz GET, no status-probe burn 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8b RED: explicit OPENRIG_URL (fan-out) -> exact target broadcast and ZERO lifecycle probe calls 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > --from is IGNORED in fan-out — BOTH envelopeSender and actorSession name the ambient transport identity, never the forged --from origin 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > F2 GREEN-characterization: with NO --from, fan-out still falls back to ambient identity (the flag is additive, not a behavior change) 1ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 4 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 human: a staged-unresolved recipient gets NO sent line and is NOT counted delivered — one verdict only
-AssertionError: expected true to be false // Object.is equality
-
-- Expected
-+ Received
-
-- false
-+ true
-
- ❯ test/send.test.ts:758:68
-    756|       const lines = logs.join("\n").split("\n");
-    757|       // the false lines must be ABSENT (desk-binding): no unqualified…
-    758|       expect(lines.some((l) => /^staged-session: sent\b/.test(l))).toB…
-       |                                                                    ^
-    759|       expect(lines.join("\n")).toContain("1/2 delivered");
-    760|       expect(lines.join("\n")).not.toContain("2/2 delivered");
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/4]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json: the same recipient can never be simultaneously delivered and staged-not-consumed in the envelope
-AssertionError: expected true to be false // Object.is equality
-
-- Expected
-+ Received
-
-- false
-+ true
-
- ❯ test/send.test.ts:775:32
-    773|       expect(stagedRow).toBeDefined();
-    774|       // ONE verdict: the staged-unresolved row is not a delivery claim
-    775|       expect(stagedRow!["ok"]).toBe(false);
-       |                                ^
-    776|       expect(stagedRow!["outcome"]).toBe("staged-not-consumed");
-    777|       expect(stagedRow!["verified"]).not.toBe(true);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[2/4]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json single-send: a staged-unresolved envelope carries no delivered claim beside the staged effect
-AssertionError: expected true not to be true // Object.is equality
- ❯ test/send.test.ts:786:40
-    784|       const envelope = JSON.parse(logs.find((l) => l.trim().startsWith…
-    785|       expect((envelope["effectCheck"] as Record<string, unknown>)["sta…
-    786|       expect(envelope["verified"]).not.toBe(true);
-       |                                        ^
-    787|       expect(envelope["outcome"]).toBe("staged-not-consumed");
-    788|     });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[3/4]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F2: an unrelated size-mismatched placeholder is UNVERIFIABLE — never staged-as-this-send, never a guarded submit
-AssertionError: expected 'Sent to unrelated-paste-session\nVeri…' not to match /staged, not consumed/i
-
-- Expected: 
-/staged, not consumed/i
-
-+ Received: 
-"Sent to unrelated-paste-session
-Verified: no
-Delivery: staged, not consumed (checked: post-send pane capture; observed: the sent text is still at the prompt — typed, never submitted)
-Remedy: one guarded Enter submitted, but the text is STILL at the prompt — not consumed; stopping here (one submit is the contract). Inspect with: rig capture unrelated-paste-session"
-
- ❯ test/send.test.ts:795:26
-    793|       });
-    794|       const output = logs.join("\n");
-    795|       expect(output).not.toMatch(/staged, not consumed/i); // no stage…
-       |                          ^
-    796|       expect(sendBodies.filter((b) => b["submitOnly"])).toHaveLength(0…
-    797|       expect(output).toMatch(/unverifiable|not .{0,20}this send|does n…
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/4]⎯
-
-
- Test Files  1 failed (1)
-      Tests  4 failed | 65 passed (69)
-   Start at  08:01:30
-   Duration  831ms (transform 283ms, setup 74ms, collect 228ms, tests 265ms, environment 0ms, prepare 103ms)
-
-vitest exit: 1

.evidence/RED-fixround3-at-57b69e405.txt

@@ -1,106 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s3-delivery-honesty/packages/cli
-
-remote okstderr | test/send.test.ts > Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped)
-Warning: RIGGED_URL is deprecated; use OPENRIG_URL instead.
-
- ❯ test/send.test.ts (69 tests | 1 failed) 587ms
-   ✓ Send CLI > send prints success output 16ms
-   ✓ Send CLI > P18: an env-less send DELIVERS with an honest `<unknown sender>` label — dispatched, actorSession null 3ms
-   ✓ Send CLI > P18: a resolvable seat SENDS with its attributed identity — actorSession derived from the seat env, never forged 80ms
-   ✓ Send CLI > P18 canonicity: '<unknown sender>' is DEFINED at EXACTLY the two named twin sites — a third fails BY NAME  373ms
-   ✓ Send CLI > send with 409 mid-work prints error and exits non-zero 2ms
-   ✓ Send CLI > prints the Advisory on an unknown-proceed send (human output) 2ms
-   ✓ Send CLI > carries the advisory as `warning` in --json output 1ms
-   ✓ Send CLI > verify confirmed prints Delivery: delivered AND the legacy Verified: yes 2ms
-   ✓ Send CLI > verify redraw-race prints Delivery: rendered-unconfirmed (landed, with capture guidance) AND legacy Verified: no 3ms
-   ✓ Send CLI > verify genuine transport failure stays an error path, distinct from the middle (discriminator) 1ms
-   ✓ Send CLI > verify --json passes the additive outcome field through 1ms
-   ✓ Send CLI > send --json prints raw JSON 1ms
-   ✓ Send CLI > send --wait-for-idle posts waitForIdleMs and extends request timeout 1ms
-   ✓ Send CLI > send without wait-for-idle uses default client timeout path 0ms
-   ✓ Send CLI > send --context resolves a ref to its whole content and sends it (single-seat local) 1ms
-   ✓ Send CLI > send --context ABORTS (no send) when the pack has a missing/unreadable member 0ms
-   ✓ Send CLI > send rejects invalid wait-for-idle values before contacting daemon 0ms
-   ✓ Send CLI > send rejects wait-for-idle with force before contacting daemon 0ms
-   ✓ Send CLI > send --raw posts the exact text without the From/To envelope 1ms
-   ✓ Send CLI > default send (no --raw) wraps the From/To messaging envelope 1ms
-   ✓ Send CLI > send --from <origin> is IGNORED — From:/actor derive from the ambient transport identity, not --from 1ms
-   ✓ Send CLI > send --dangerously-interact --reason posts the override fields with raw (exact) text 1ms
-   ✓ Send CLI > send --dangerously-interact without --reason is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --dangerously-interact + --wait-for-idle is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --host forwards --raw/--dangerously-interact/--reason in the reconstructed remote argv 1ms
-   ✓ Send CLI > send --context rejects the agent@rig@host sugar cross-host form (NO message) — never reaches remote argv 1ms
-   ✓ Send CLI > send --context rejects the sugar cross-host form (WITH message) — context not silently dropped 0ms
-   ✓ Send CLI > send --to a,b fans out to /broadcast with a sessions list and prints per-recipient summary 1ms
-   ✓ Send CLI > send --to accepts repetition (--to a --to b) and sets the daemon-side envelopeSender 1ms
-   ✓ Send CLI > send --pod posts a pod target to /broadcast 1ms
-   ✓ Send CLI > send --rig posts a rig target to /broadcast 2ms
-   ✓ Send CLI > fan-out with one recipient failing prints which failed, the summary, and exits nonzero 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-1: a send whose text sits AT the prompt is reported STAGED — by pane effect, not the transport's verified:true 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-2: a genuinely consumed send verifies positively and is NEVER reported staged 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-3: the staged remedy is the single submit path — exactly one plain-text send, no blind re-send suggested or performed 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F3: a stale pasted-text placeholder in SCROLLBACK is NOT staged evidence — no staged report, no guarded submit fired 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: --json with --verify carries the effect classification in the envelope (staged case) 3ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: fan-out with --verify reports per-recipient effect — staged named, consumed never claimed staged 3ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 human: a staged-unresolved recipient gets NO sent line and is NOT counted delivered — one verdict only 2ms
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json: the same recipient can never be simultaneously delivered and staged-not-consumed in the envelope 6ms
-     → expected 2 to be 1 // Object.is equality
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json single-send: a staged-unresolved envelope carries no delivered claim beside the staged effect 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F2: an unrelated size-mismatched placeholder is UNVERIFIABLE — never staged-as-this-send, never a guarded submit 1ms
-   ✓ Send CLI > fan-out renderer surfaces the unknown-sender notice from the response warning 1ms
-   ✓ Send CLI > fan-out --raw sends bare exact text with NO envelopeSender (no per-recipient wrap) 2ms
-   ✓ Send CLI > fan-out --dangerously-interact --reason plumbs the danger fields (bare text, no envelope) 1ms
-   ✓ Send CLI > rejects combining a bare seat with a fan-out flag 0ms
-   ✓ Send CLI > rejects more than one fan-out mode at once 0ms
-   ✓ Send CLI > rejects --wait-for-idle with a multi/pod/rig target 0ms
-   ✓ Send CLI > single-seat send is UNCHANGED — still posts to /send, byte-identical envelope, no /broadcast 1ms
-   ✓ Send CLI > send --help includes rediscovery examples + the new guard flags 1ms
-   ✓ Send CLI > send --help documents proceed-with-advisory on unknown telemetry, not fail-closed 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R1 RED: single-seat + OPENRIG_URL custom port + probe-stopped -> actual POST lands, exact env target passed to clientFactory 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R2 RED: fan-out --to + OPENRIG_URL + probe-stopped -> actual /broadcast lands with per-recipient results 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R4 RED: precedence — OPENRIG_URL wins over RIGGED_URL on the transport-authoritative path 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R5 RED: RUNNING-but-UNHEALTHY (event-loop-starved healthz body) must still send (single-seat + fan-out) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6 RED: NO env + live-pid state file (custom port) + healthz probe failing -> POST attempted against the state-derived target 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6b RED: NO env + NO daemon state + probe-stopped -> POST attempted against the configured DEFAULT target (injected client succeeds) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6c RED: NO env + NO state + probe-stopped + ConfigStore CUSTOM daemon host/port -> POST attempted against the CONFIGURED-FILE target exactly (no hardcoded default) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7 RED: REAL down fails honestly — actual connection error names the target; the bare preflight restart line never appears 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7b RED: fan-out REAL down fails honestly too — target-specific connection error, exit 1, no restart line, and the same remediation as single-seat 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7c RED: single-seat --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7d RED: fan-out --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7e: single-seat HUMAN transport failure keeps stdout empty (mirror of R7c) — the 3 remediation lines are stderr-only, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7f: fan-out HUMAN transport failure keeps stdout empty (mirror of R7d) — stderr-only remediation, exit 1 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8: explicit OPENRIG_URL (single-seat) -> exact target POSTed + EXACTLY ONE self-id /healthz GET, no status-probe burn 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8b RED: explicit OPENRIG_URL (fan-out) -> exact target broadcast and ZERO lifecycle probe calls 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > --from is IGNORED in fan-out — BOTH envelopeSender and actorSession name the ambient transport identity, never the forged --from origin 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > F2 GREEN-characterization: with NO --from, fan-out still falls back to ambient identity (the flag is additive, not a behavior change) 1ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json: the same recipient can never be simultaneously delivered and staged-not-consumed in the envelope
-AssertionError: expected 2 to be 1 // Object.is equality
-
-- Expected
-+ Received
-
-- 1
-+ 2
-
- ❯ test/send.test.ts:780:32
-    778|       // Round-3 (r2 row 00fb3a68): the AGGREGATE is derived from the …
-    779|       // encoded outcomes — a staged-unresolved recipient is never cou…
-    780|       expect(envelope["sent"]).toBe(1); // RED at 57b69e405: raw trans…
-       |                                ^
-    781|       expect(envelope["failed"]).toBe(1);
-    782|     });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/1]⎯
-
-
- Test Files  1 failed (1)
-      Tests  1 failed | 68 passed (69)
-   Start at  08:10:58
-   Duration  1.19s (transform 238ms, setup 36ms, collect 385ms, tests 587ms, environment 0ms, prepare 44ms)
-
-vitest exit: 1

.evidence/RED-fixround3-final-testset-at-base-57b69e405.txt

@@ -1,106 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s3r3-base/packages/cli
-
-remote okstderr | test/send.test.ts > Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped)
-Warning: RIGGED_URL is deprecated; use OPENRIG_URL instead.
-
- ❯ test/send.test.ts (69 tests | 1 failed) 184ms
-   ✓ Send CLI > send prints success output 14ms
-   ✓ Send CLI > P18: an env-less send DELIVERS with an honest `<unknown sender>` label — dispatched, actorSession null 2ms
-   ✓ Send CLI > P18: a resolvable seat SENDS with its attributed identity — actorSession derived from the seat env, never forged 2ms
-   ✓ Send CLI > P18 canonicity: '<unknown sender>' is DEFINED at EXACTLY the two named twin sites — a third fails BY NAME 91ms
-   ✓ Send CLI > send with 409 mid-work prints error and exits non-zero 2ms
-   ✓ Send CLI > prints the Advisory on an unknown-proceed send (human output) 2ms
-   ✓ Send CLI > carries the advisory as `warning` in --json output 1ms
-   ✓ Send CLI > verify confirmed prints Delivery: delivered AND the legacy Verified: yes 3ms
-   ✓ Send CLI > verify redraw-race prints Delivery: rendered-unconfirmed (landed, with capture guidance) AND legacy Verified: no 4ms
-   ✓ Send CLI > verify genuine transport failure stays an error path, distinct from the middle (discriminator) 1ms
-   ✓ Send CLI > verify --json passes the additive outcome field through 3ms
-   ✓ Send CLI > send --json prints raw JSON 1ms
-   ✓ Send CLI > send --wait-for-idle posts waitForIdleMs and extends request timeout 1ms
-   ✓ Send CLI > send without wait-for-idle uses default client timeout path 0ms
-   ✓ Send CLI > send --context resolves a ref to its whole content and sends it (single-seat local) 1ms
-   ✓ Send CLI > send --context ABORTS (no send) when the pack has a missing/unreadable member 0ms
-   ✓ Send CLI > send rejects invalid wait-for-idle values before contacting daemon 0ms
-   ✓ Send CLI > send rejects wait-for-idle with force before contacting daemon 0ms
-   ✓ Send CLI > send --raw posts the exact text without the From/To envelope 1ms
-   ✓ Send CLI > default send (no --raw) wraps the From/To messaging envelope 1ms
-   ✓ Send CLI > send --from <origin> is IGNORED — From:/actor derive from the ambient transport identity, not --from 1ms
-   ✓ Send CLI > send --dangerously-interact --reason posts the override fields with raw (exact) text 1ms
-   ✓ Send CLI > send --dangerously-interact without --reason is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --dangerously-interact + --wait-for-idle is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --host forwards --raw/--dangerously-interact/--reason in the reconstructed remote argv 1ms
-   ✓ Send CLI > send --context rejects the agent@rig@host sugar cross-host form (NO message) — never reaches remote argv 0ms
-   ✓ Send CLI > send --context rejects the sugar cross-host form (WITH message) — context not silently dropped 0ms
-   ✓ Send CLI > send --to a,b fans out to /broadcast with a sessions list and prints per-recipient summary 1ms
-   ✓ Send CLI > send --to accepts repetition (--to a --to b) and sets the daemon-side envelopeSender 1ms
-   ✓ Send CLI > send --pod posts a pod target to /broadcast 1ms
-   ✓ Send CLI > send --rig posts a rig target to /broadcast 1ms
-   ✓ Send CLI > fan-out with one recipient failing prints which failed, the summary, and exits nonzero 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-1: a send whose text sits AT the prompt is reported STAGED — by pane effect, not the transport's verified:true 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-2: a genuinely consumed send verifies positively and is NEVER reported staged 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-3: the staged remedy is the single submit path — exactly one plain-text send, no blind re-send suggested or performed 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F3: a stale pasted-text placeholder in SCROLLBACK is NOT staged evidence — no staged report, no guarded submit fired 1ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: --json with --verify carries the effect classification in the envelope (staged case) 3ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > F2: fan-out with --verify reports per-recipient effect — staged named, consumed never claimed staged 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 human: a staged-unresolved recipient gets NO sent line and is NOT counted delivered — one verdict only 2ms
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json: the same recipient can never be simultaneously delivered and staged-not-consumed in the envelope 6ms
-     → expected 2 to be 1 // Object.is equality
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json single-send: a staged-unresolved envelope carries no delivered claim beside the staged effect 2ms
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F2: an unrelated size-mismatched placeholder is UNVERIFIABLE — never staged-as-this-send, never a guarded submit 1ms
-   ✓ Send CLI > fan-out renderer surfaces the unknown-sender notice from the response warning 1ms
-   ✓ Send CLI > fan-out --raw sends bare exact text with NO envelopeSender (no per-recipient wrap) 2ms
-   ✓ Send CLI > fan-out --dangerously-interact --reason plumbs the danger fields (bare text, no envelope) 1ms
-   ✓ Send CLI > rejects combining a bare seat with a fan-out flag 0ms
-   ✓ Send CLI > rejects more than one fan-out mode at once 0ms
-   ✓ Send CLI > rejects --wait-for-idle with a multi/pod/rig target 0ms
-   ✓ Send CLI > single-seat send is UNCHANGED — still posts to /send, byte-identical envelope, no /broadcast 1ms
-   ✓ Send CLI > send --help includes rediscovery examples + the new guard flags 1ms
-   ✓ Send CLI > send --help documents proceed-with-advisory on unknown telemetry, not fail-closed 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R1 RED: single-seat + OPENRIG_URL custom port + probe-stopped -> actual POST lands, exact env target passed to clientFactory 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R2 RED: fan-out --to + OPENRIG_URL + probe-stopped -> actual /broadcast lands with per-recipient results 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R4 RED: precedence — OPENRIG_URL wins over RIGGED_URL on the transport-authoritative path 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R5 RED: RUNNING-but-UNHEALTHY (event-loop-starved healthz body) must still send (single-seat + fan-out) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6 RED: NO env + live-pid state file (custom port) + healthz probe failing -> POST attempted against the state-derived target 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6b RED: NO env + NO daemon state + probe-stopped -> POST attempted against the configured DEFAULT target (injected client succeeds) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6c RED: NO env + NO state + probe-stopped + ConfigStore CUSTOM daemon host/port -> POST attempted against the CONFIGURED-FILE target exactly (no hardcoded default) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7 RED: REAL down fails honestly — actual connection error names the target; the bare preflight restart line never appears 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7b RED: fan-out REAL down fails honestly too — target-specific connection error, exit 1, no restart line, and the same remediation as single-seat 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7c RED: single-seat --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7d RED: fan-out --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7e: single-seat HUMAN transport failure keeps stdout empty (mirror of R7c) — the 3 remediation lines are stderr-only, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7f: fan-out HUMAN transport failure keeps stdout empty (mirror of R7d) — stderr-only remediation, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8: explicit OPENRIG_URL (single-seat) -> exact target POSTed + EXACTLY ONE self-id /healthz GET, no status-probe burn 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8b RED: explicit OPENRIG_URL (fan-out) -> exact target broadcast and ZERO lifecycle probe calls 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > --from is IGNORED in fan-out — BOTH envelopeSender and actorSession name the ambient transport identity, never the forged --from origin 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > F2 GREEN-characterization: with NO --from, fan-out still falls back to ambient identity (the flag is additive, not a behavior change) 1ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > R2-F1 json: the same recipient can never be simultaneously delivered and staged-not-consumed in the envelope
-AssertionError: expected 2 to be 1 // Object.is equality
-
-- Expected
-+ Received
-
-- 1
-+ 2
-
- ❯ test/send.test.ts:780:32
-    778|       // Round-3 (r2 row 00fb3a68): the AGGREGATE is derived from the …
-    779|       // encoded outcomes — a staged-unresolved recipient is never cou…
-    780|       expect(envelope["sent"]).toBe(1); // RED at 57b69e405: raw trans…
-       |                                ^
-    781|       expect(envelope["failed"]).toBe(1);
-    782|     });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/1]⎯
-
-
- Test Files  1 failed (1)
-      Tests  1 failed | 68 passed (69)
-   Start at  08:12:21
-   Duration  554ms (transform 137ms, setup 30ms, collect 176ms, tests 184ms, environment 0ms, prepare 36ms)
-
-vitest exit: 1

.evidence/RED-run-amended-testset-at-base-be23eb200.txt

@@ -1,246 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s1-base-red/packages/daemon
-
- ❯ test/one-honest-resolution-path.test.ts (19 tests | 13 failed) 392ms
-   × adapter gate: probeSession classifies instead of collapsing > no-server → transport answer, not absence 19ms
-     → adapter.probeSession is not a function
-   × adapter gate: probeSession classifies instead of collapsing > socket-gone → transport answer, not absence 0ms
-     → adapter.probeSession is not a function
-   × adapter gate: probeSession classifies instead of collapsing > can't find session → positive absence 0ms
-     → adapter.probeSession is not a function
-   × adapter gate: probeSession classifies instead of collapsing > permission denied → fail-closed throw, distinct from both classes 0ms
-     → adapter.probeSession is not a function
-   × adapter gate: probeSession classifies instead of collapsing > present session → present 0ms
-     → adapter.probeSession is not a function
-   ✓ adapter gate: probeSession classifies instead of collapsing > hasSession keeps the collapsed view for unbound consumers 1ms
-   × one path at the verbs: send and capture surface the transport outcome > send under no-server surfaces tmux_unavailable, never session_missing 46ms
-     → expected 'session_missing' to be 'tmux_unavailable' // Object.is equality
-   × one path at the verbs: send and capture surface the transport outcome > send under socket-gone surfaces tmux_unavailable, never session_missing 7ms
-     → expected 'session_missing' to be 'tmux_unavailable' // Object.is equality
-   × one path at the verbs: send and capture surface the transport outcome > capture under no-server surfaces tmux_unavailable, never session_missing 21ms
-     → expected 'session_missing' to be 'tmux_unavailable' // Object.is equality
-   ✓ one path at the verbs: send and capture surface the transport outcome > send under genuine absence still surfaces session_missing 23ms
-   × one path at the verbs: send and capture surface the transport outcome > error text names what was actually checked (queue-create bar) > transport text states the failed reach AND that existence was not determined 39ms
-     → expected 'Session \'dev-impl@my-rig\' not found…' to match /could not be reached|not reachable/i
-   × one path at the verbs: send and capture surface the transport outcome > error text names what was actually checked (queue-create bar) > session-missing text states its positive tmux evidence 151ms
-     → expected 'Session \'dev-impl@my-rig\' not found…' to match /tmux reports no session/i
-   × one path at the verbs: send and capture surface the transport outcome > walk's route (/api/transport/send) surfaces the transport outcome under no-server 13ms
-     → expected 'session_missing' to be 'tmux_unavailable' // Object.is equality
-   × one path at the verbs: send and capture surface the transport outcome > no fabricated verdicts (mini-req 5) > a transport blip against a live registered seat writes NO absence verdict and ps does not down-rank it 10ms
-     → expected [ { …(10) } ] to have a length of +0 but got 1
-   × one path at the verbs: send and capture surface the transport outcome > no fabricated verdicts (mini-req 5) > a socket-gone blip likewise writes NO absence verdict and ps does not down-rank it 8ms
-     → expected [ { …(10) } ] to have a length of +0 but got 1
-   ✓ one path at the verbs: send and capture surface the transport outcome > no fabricated verdicts (mini-req 5) > genuine session absence still writes the verdict and ps down-ranks the seat 16ms
-   ✓ cold-start preserved: boot reconciliation still detaches under a dead server (mini-req 2) > no-server: stale rows are detached, not errored 11ms
-   ✓ cold-start preserved: boot reconciliation still detaches under a dead server (mini-req 2) > socket-gone: stale rows are detached, not errored 12ms
-   ✓ cold-start preserved: boot reconciliation still detaches under a dead server (mini-req 2) > permission denied stays fail-closed: errored, never detached 11ms
-
-⎯⎯⎯⎯⎯⎯ Failed Tests 13 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > adapter gate: probeSession classifies instead of collapsing > no-server → transport answer, not absence
-TypeError: adapter.probeSession is not a function
- ❯ test/one-honest-resolution-path.test.ts:38:33
-     36|   it("no-server → transport answer, not absence", async () => {
-     37|     const adapter = new TmuxAdapter(failingExec(NO_SERVER));
-     38|     const probe = await adapter.probeSession(SEAT);
-       |                                 ^
-     39|     expect(probe.state).toBe("transport_unavailable");
-     40|   });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > adapter gate: probeSession classifies instead of collapsing > socket-gone → transport answer, not absence
-TypeError: adapter.probeSession is not a function
- ❯ test/one-honest-resolution-path.test.ts:44:33
-     42|   it("socket-gone → transport answer, not absence", async () => {
-     43|     const adapter = new TmuxAdapter(failingExec(SOCKET_GONE));
-     44|     const probe = await adapter.probeSession(SEAT);
-       |                                 ^
-     45|     expect(probe.state).toBe("transport_unavailable");
-     46|   });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[2/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > adapter gate: probeSession classifies instead of collapsing > can't find session → positive absence
-TypeError: adapter.probeSession is not a function
- ❯ test/one-honest-resolution-path.test.ts:50:33
-     48|   it("can't find session → positive absence", async () => {
-     49|     const adapter = new TmuxAdapter(failingExec(SESSION_GONE));
-     50|     const probe = await adapter.probeSession(SEAT);
-       |                                 ^
-     51|     expect(probe.state).toBe("absent");
-     52|   });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[3/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > adapter gate: probeSession classifies instead of collapsing > permission denied → fail-closed throw, distinct from both classes
-TypeError: adapter.probeSession is not a function
- ❯ test/one-honest-resolution-path.test.ts:56:26
-     54|   it("permission denied → fail-closed throw, distinct from both classe…
-     55|     const adapter = new TmuxAdapter(failingExec(PERMISSION));
-     56|     await expect(adapter.probeSession(SEAT)).rejects.toThrow("permissi…
-       |                          ^
-     57|   });
-     58| 
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > adapter gate: probeSession classifies instead of collapsing > present session → present
-TypeError: adapter.probeSession is not a function
- ❯ test/one-honest-resolution-path.test.ts:61:33
-     59|   it("present session → present", async () => {
-     60|     const adapter = new TmuxAdapter(async () => "");
-     61|     const probe = await adapter.probeSession(SEAT);
-       |                                 ^
-     62|     expect(probe.state).toBe("present");
-     63|   });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[5/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > one path at the verbs: send and capture surface the transport outcome > send under no-server surfaces tmux_unavailable, never session_missing
-AssertionError: expected 'session_missing' to be 'tmux_unavailable' // Object.is equality
-
-Expected: "tmux_unavailable"
-Received: "session_missing"
-
- ❯ test/one-honest-resolution-path.test.ts:117:27
-    115|     const result = await transportOver(NO_SERVER).send(SEAT, "hello");
-    116|     expect(result.ok).toBe(false);
-    117|     expect(result.reason).toBe("tmux_unavailable");
-       |                           ^
-    118|   });
-    119| 
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[6/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > one path at the verbs: send and capture surface the transport outcome > send under socket-gone surfaces tmux_unavailable, never session_missing
-AssertionError: expected 'session_missing' to be 'tmux_unavailable' // Object.is equality
-
-Expected: "tmux_unavailable"
-Received: "session_missing"
-
- ❯ test/one-honest-resolution-path.test.ts:124:27
-    122|     const result = await transportOver(SOCKET_GONE).send(SEAT, "hello"…
-    123|     expect(result.ok).toBe(false);
-    124|     expect(result.reason).toBe("tmux_unavailable");
-       |                           ^
-    125|   });
-    126| 
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[7/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > one path at the verbs: send and capture surface the transport outcome > capture under no-server surfaces tmux_unavailable, never session_missing
-AssertionError: expected 'session_missing' to be 'tmux_unavailable' // Object.is equality
-
-Expected: "tmux_unavailable"
-Received: "session_missing"
-
- ❯ test/one-honest-resolution-path.test.ts:131:27
-    129|     const result = await transportOver(NO_SERVER).capture(SEAT);
-    130|     expect(result.ok).toBe(false);
-    131|     expect(result.reason).toBe("tmux_unavailable");
-       |                           ^
-    132|   });
-    133| 
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[8/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > one path at the verbs: send and capture surface the transport outcome > error text names what was actually checked (queue-create bar) > transport text states the failed reach AND that existence was not determined
-AssertionError: expected 'Session \'dev-impl@my-rig\' not found…' to match /could not be reached|not reachable/i
-
-- Expected: 
-/could not be reached|not reachable/i
-
-+ Received: 
-"Session 'dev-impl@my-rig' not found. Check available sessions with: rig ps --nodes"
-
- ❯ test/one-honest-resolution-path.test.ts:147:28
-    145|       expect(result.ok).toBe(false);
-    146|       if (result.ok) return;
-    147|       expect(result.error).toMatch(/could not be reached|not reachable…
-       |                            ^
-    148|       expect(result.error).toMatch(/not determined/i);
-    149|       // No false world-conclusion: the text may not claim the session…
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[9/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > one path at the verbs: send and capture surface the transport outcome > error text names what was actually checked (queue-create bar) > session-missing text states its positive tmux evidence
-AssertionError: expected 'Session \'dev-impl@my-rig\' not found…' to match /tmux reports no session/i
-
-- Expected: 
-/tmux reports no session/i
-
-+ Received: 
-"Session 'dev-impl@my-rig' not found. Check available sessions with: rig ps --nodes"
-
- ❯ test/one-honest-resolution-path.test.ts:158:28
-    156|       expect(result.ok).toBe(false);
-    157|       if (result.ok) return;
-    158|       expect(result.error).toMatch(/tmux reports no session/i);
-       |                            ^
-    159|     });
-    160|   });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[10/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > one path at the verbs: send and capture surface the transport outcome > walk's route (/api/transport/send) surfaces the transport outcome under no-server
-AssertionError: expected 'session_missing' to be 'tmux_unavailable' // Object.is equality
-
-Expected: "tmux_unavailable"
-Received: "session_missing"
-
- ❯ test/one-honest-resolution-path.test.ts:184:25
-    182|     });
-    183|     const body = (await res.json()) as { reason?: string; error?: stri…
-    184|     expect(body.reason).toBe("tmux_unavailable");
-       |                         ^
-    185|     expect(body.error).toMatch(/not determined/i);
-    186|   });
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[11/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > one path at the verbs: send and capture surface the transport outcome > no fabricated verdicts (mini-req 5) > a transport blip against a live registered seat writes NO absence verdict and ps does not down-rank it
-AssertionError: expected [ { …(10) } ] to have a length of +0 but got 1
-
-- Expected
-+ Received
-
-- 0
-+ 1
-
- ❯ test/one-honest-resolution-path.test.ts:192:29
-    190|       seedSeat();
-    191|       await transportOver(NO_SERVER).send(SEAT, "hello");
-    192|       expect(verdictRows()).toHaveLength(0);
-       |                             ^
-    193|       // The EFFECT, not just the indicator (proof item 4): the live s…
-    194|       // projected as running after the blip.
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[12/13]⎯
-
- FAIL  test/one-honest-resolution-path.test.ts > one path at the verbs: send and capture surface the transport outcome > no fabricated verdicts (mini-req 5) > a socket-gone blip likewise writes NO absence verdict and ps does not down-rank it
-AssertionError: expected [ { …(10) } ] to have a length of +0 but got 1
-
-- Expected
-+ Received
-
-- 0
-+ 1
-
- ❯ test/one-honest-resolution-path.test.ts:203:29
-    201|       seedSeat();
-    202|       await transportOver(SOCKET_GONE).capture(SEAT);
-    203|       expect(verdictRows()).toHaveLength(0);
-       |                             ^
-    204|       const entry = new PsProjectionService({ db }).getEntries()[0]!;
-    205|       expect(entry.runningCount).toBe(1);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[13/13]⎯
-
-
- Test Files  1 failed (1)
-      Tests  13 failed | 6 passed (19)
-   Start at  05:37:22
-   Duration  2.34s (transform 1.15s, setup 0ms, collect 1.67s, tests 392ms, environment 0ms, prepare 59ms)
-
-vitest exit: 1

.evidence/RED-s3-final-testset-at-base-366642f43.txt

@@ -1,121 +0,0 @@
-
- RUN  v3.2.4 /private/tmp/s3-base-red/packages/cli
-
-remote okstderr | test/send.test.ts > Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped)
-Warning: RIGGED_URL is deprecated; use OPENRIG_URL instead.
-
- ❯ test/send.test.ts (62 tests | 2 failed) 377ms
-   ✓ Send CLI > send prints success output 16ms
-   ✓ Send CLI > P18: an env-less send DELIVERS with an honest `<unknown sender>` label — dispatched, actorSession null 3ms
-   ✓ Send CLI > P18: a resolvable seat SENDS with its attributed identity — actorSession derived from the seat env, never forged 2ms
-   ✓ Send CLI > P18 canonicity: '<unknown sender>' is DEFINED at EXACTLY the two named twin sites — a third fails BY NAME 279ms
-   ✓ Send CLI > send with 409 mid-work prints error and exits non-zero 7ms
-   ✓ Send CLI > prints the Advisory on an unknown-proceed send (human output) 2ms
-   ✓ Send CLI > carries the advisory as `warning` in --json output 2ms
-   ✓ Send CLI > verify confirmed prints Delivery: delivered AND the legacy Verified: yes 1ms
-   ✓ Send CLI > verify redraw-race prints Delivery: rendered-unconfirmed (landed, with capture guidance) AND legacy Verified: no 1ms
-   ✓ Send CLI > verify genuine transport failure stays an error path, distinct from the middle (discriminator) 3ms
-   ✓ Send CLI > verify --json passes the additive outcome field through 1ms
-   ✓ Send CLI > send --json prints raw JSON 1ms
-   ✓ Send CLI > send --wait-for-idle posts waitForIdleMs and extends request timeout 2ms
-   ✓ Send CLI > send without wait-for-idle uses default client timeout path 0ms
-   ✓ Send CLI > send --context resolves a ref to its whole content and sends it (single-seat local) 1ms
-   ✓ Send CLI > send --context ABORTS (no send) when the pack has a missing/unreadable member 0ms
-   ✓ Send CLI > send rejects invalid wait-for-idle values before contacting daemon 0ms
-   ✓ Send CLI > send rejects wait-for-idle with force before contacting daemon 0ms
-   ✓ Send CLI > send --raw posts the exact text without the From/To envelope 1ms
-   ✓ Send CLI > default send (no --raw) wraps the From/To messaging envelope 1ms
-   ✓ Send CLI > send --from <origin> is IGNORED — From:/actor derive from the ambient transport identity, not --from 1ms
-   ✓ Send CLI > send --dangerously-interact --reason posts the override fields with raw (exact) text 1ms
-   ✓ Send CLI > send --dangerously-interact without --reason is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --dangerously-interact + --wait-for-idle is rejected before contacting the daemon 0ms
-   ✓ Send CLI > send --host forwards --raw/--dangerously-interact/--reason in the reconstructed remote argv 2ms
-   ✓ Send CLI > send --context rejects the agent@rig@host sugar cross-host form (NO message) — never reaches remote argv 1ms
-   ✓ Send CLI > send --context rejects the sugar cross-host form (WITH message) — context not silently dropped 0ms
-   ✓ Send CLI > send --to a,b fans out to /broadcast with a sessions list and prints per-recipient summary 3ms
-   ✓ Send CLI > send --to accepts repetition (--to a --to b) and sets the daemon-side envelopeSender 1ms
-   ✓ Send CLI > send --pod posts a pod target to /broadcast 1ms
-   ✓ Send CLI > send --rig posts a rig target to /broadcast 1ms
-   ✓ Send CLI > fan-out with one recipient failing prints which failed, the summary, and exits nonzero 1ms
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-1: a send whose text sits AT the prompt is reported STAGED — by pane effect, not the transport's verified:true 6ms
-     → expected 'Sent to staged-session\nVerified: yes…' to match /not (yet )?consumed|not submitted|st…/i
-   ✓ Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-2: a genuinely consumed send verifies positively and is NEVER reported staged 1ms
-   × Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-3: the staged remedy is the single submit path — exactly one plain-text send, no blind re-send suggested or performed 3ms
-     → expected [] to have a length of 1 but got +0
-   ✓ Send CLI > fan-out renderer surfaces the unknown-sender notice from the response warning 1ms
-   ✓ Send CLI > fan-out --raw sends bare exact text with NO envelopeSender (no per-recipient wrap) 1ms
-   ✓ Send CLI > fan-out --dangerously-interact --reason plumbs the danger fields (bare text, no envelope) 3ms
-   ✓ Send CLI > rejects combining a bare seat with a fan-out flag 0ms
-   ✓ Send CLI > rejects more than one fan-out mode at once 0ms
-   ✓ Send CLI > rejects --wait-for-idle with a multi/pod/rig target 0ms
-   ✓ Send CLI > single-seat send is UNCHANGED — still posts to /send, byte-identical envelope, no /broadcast 3ms
-   ✓ Send CLI > send --help includes rediscovery examples + the new guard flags 1ms
-   ✓ Send CLI > send --help documents proceed-with-advisory on unknown telemetry, not fail-closed 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R1 RED: single-seat + OPENRIG_URL custom port + probe-stopped -> actual POST lands, exact env target passed to clientFactory 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R2 RED: fan-out --to + OPENRIG_URL + probe-stopped -> actual /broadcast lands with per-recipient results 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R3 RED: legacy RIGGED_URL custom port honored when OPENRIG_URL unset (probe-stopped) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R4 RED: precedence — OPENRIG_URL wins over RIGGED_URL on the transport-authoritative path 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R5 RED: RUNNING-but-UNHEALTHY (event-loop-starved healthz body) must still send (single-seat + fan-out) 2ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6 RED: NO env + live-pid state file (custom port) + healthz probe failing -> POST attempted against the state-derived target 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6b RED: NO env + NO daemon state + probe-stopped -> POST attempted against the configured DEFAULT target (injected client succeeds) 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R6c RED: NO env + NO state + probe-stopped + ConfigStore CUSTOM daemon host/port -> POST attempted against the CONFIGURED-FILE target exactly (no hardcoded default) 3ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7 RED: REAL down fails honestly — actual connection error names the target; the bare preflight restart line never appears 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7b RED: fan-out REAL down fails honestly too — target-specific connection error, exit 1, no restart line, and the same remediation as single-seat 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7c RED: single-seat --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 1ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7d RED: fan-out --json transport failure emits exactly one parseable stdout JSON envelope, empty stderr, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7e: single-seat HUMAN transport failure keeps stdout empty (mirror of R7c) — the 3 remediation lines are stderr-only, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R7f: fan-out HUMAN transport failure keeps stdout empty (mirror of R7d) — stderr-only remediation, exit 1 0ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8: explicit OPENRIG_URL (single-seat) -> exact target POSTed + EXACTLY ONE self-id /healthz GET, no status-probe burn 3ms
-   ✓ Send CLI > qitem-c113bd41 — transport-authoritative local send (RED vs preflight refusal) > R8b RED: explicit OPENRIG_URL (fan-out) -> exact target broadcast and ZERO lifecycle probe calls 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > --from is IGNORED in fan-out — BOTH envelopeSender and actorSession name the ambient transport identity, never the forged --from origin 1ms
-   ✓ Send CLI > P21 I4 — fan-out IGNORES --from; identity derives from the transport (reverses ba41fea2) > F2 GREEN-characterization: with NO --from, fan-out still falls back to ambient identity (the flag is additive, not a behavior change) 1ms
-
-⎯⎯⎯⎯⎯⎯⎯ Failed Tests 2 ⎯⎯⎯⎯⎯⎯⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-1: a send whose text sits AT the prompt is reported STAGED — by pane effect, not the transport's verified:true
-AssertionError: expected 'Sent to staged-session\nVerified: yes…' to match /not (yet )?consumed|not submitted|st…/i
-
-- Expected: 
-/not (yet )?consumed|not submitted|still at the prompt/i
-
-+ Received: 
-"Sent to staged-session
-Verified: yes
-Delivery: delivered (message landed; render confirmed)"
-
- ❯ test/send.test.ts:675:22
-    673|       // "Verified: yes" and no staged report exists.
-    674|       expect(output).toMatch(/staged/i);
-    675|       expect(output).toMatch(/not (yet )?consumed|not submitted|still …
-       |                      ^
-    676|     });
-    677| 
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/2]⎯
-
- FAIL  test/send.test.ts > Send CLI > S3 — delivery honesty (OPR.0.5.4.6): staged-vs-consumed by pane effect > PROOF-3: the staged remedy is the single submit path — exactly one plain-text send, no blind re-send suggested or performed
-AssertionError: expected [] to have a length of 1 but got +0
-
-- Expected
-+ Received
-
-- 1
-+ 0
-
- ❯ test/send.test.ts:694:26
-    692|       // exactly ONE plain-text delivery of these bytes ever hits the …
-    693|       const plainSends = sendBodies.filter((b) => !b["submitOnly"] && …
-    694|       expect(plainSends).toHaveLength(1);
-       |                          ^
-    695|       // the report points at the submit path, never a re-send
-    696|       expect(output).toMatch(/submit|Enter/i);
-
-⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[2/2]⎯
-
-
- Test Files  1 failed (1)
-      Tests  2 failed | 60 passed (62)
-   Start at  06:56:06
-   Duration  808ms (transform 152ms, setup 30ms, collect 214ms, tests 377ms, environment 0ms, prepare 39ms)
-
-vitest exit: 1

.evidence/REFUSAL-SWEEP.txt

@@ -1,2 +0,0 @@
-S2 REFUSAL SWEEP — 'unattributable_sender' occurrences in routes/transport.ts: 0 (was 3 sites pre-fix)
-Across all of packages/daemon/src/routes/: 1 — no transport delivery path refuses for attribution.

.evidence/S3-RECEIPTS.txt

@@ -1,9 +0,0 @@
-S3 GREEN + PROOF RECEIPTS (candidate at base 366642f43)
-
-GREEN (direct exits): cli send+broadcast+send-header 88/88 exit 0; cli tsc exit 0 (daemon dist built); daemon untouched by S3 (send.ts + send.test.ts only).
-Base-RED (final test bytes, pristine 366642f43 worktree): PROOF-1 + PROOF-3 failed, PROOF-2 pin passed, 60 prior green, vitest exit 1 — RED-s3-final-testset-at-base-366642f43.txt
-Disjointness receipt: git diff --name-only 886c3f1d5 366642f43 → S6 files only (context.ts, daemon-db-path, plugin-vendor, their tests) — no S3-territory overlap.
-
-PROOF ITEM 4 (interim lore retired): recorded CUTOVER-GATED in the guidance that taught it:
-  ~/.claude/projects/-Users-admin-code-openrig-build-source/memory/negative-delivery-signals.md (the 2026-08-18 staged-at-prompt lore + retirement note)
-  (dev-planner LEARNED also carries the discipline — its owner's to update, named as follow-on since S1.)

.evidence/S6-GREEN-EFFECTS.md

@@ -1,68 +0,0 @@
-# S6 GREEN + effect receipt
-
-Rebased base: `886c3f1d5def1e1140ef97b3739f81e178a62639`
-Runtime: Node `v22.23.1`
-
-## Environment integrity
-
-The package self-check passed before builds and tests:
-
-```text
-WORKTREE_SELF_CHECK_OK
-packages/daemon == node_modules/@openrig/daemon
-```
-
-The authored proof items in `SPEC.md` and `IMPLEMENTATION-PRD.md` compare
-byte-for-byte after excluding the PRD's permitted mirror banner:
-
-```text
-PROOF_ITEMS_EXACT
-```
-
-The pre-edit PRD snapshot is `.evidence/S6-IMPLEMENTATION-PRD-before.md`
-(`e48b8929df16fbcffa88c6fe48c00a222c4b968d7b121a129ffdb9b9d7d5bf7d`);
-the populated workspace PRD hash is
-`38a5a142d95f59d481296c926f9b44bf4134ce4a6bffd25100c58b50af5fc013`.
-
-## Build + focused test receipt
-
-Both package builds exited 0:
-
-```bash
-npm run build -w packages/daemon
-npm run build -w packages/cli
-```
-
-The post-rebase focused run exited 0:
-
-```bash
-npx vitest run --maxWorkers=1 \
-  packages/daemon/test/daemon-db-path.test.ts \
-  packages/daemon/test/plugin-vendor-service.test.ts \
-  packages/daemon/test/plugin-vendor-exec-mode.test.ts \
-  packages/cli/test/context-recap-write.test.ts
-```
-
-```text
-Test Files  4 passed (4)
-Tests      37 passed (37)
-```
-
-## Contract effects
-
-1. **DB outside home:** a real `home/openrig.sqlite` symlink to an outside
-   sentinel file is rejected before open; the error contains both `realpath`
-   identities and the sentinel bytes remain unchanged. A real explicit
-   split-path database is opened, receives a table and row, can be reopened
-   read-only, and no home-local database is created.
-2. **No canon rollback:** a real unversioned global skill symlinked to shared
-   canon remains byte-identical and gains no OpenRig marker; the skip log names
-   its external authority. A real older marked projection is updated to the
-   newer skill bytes and marker. Unit pins cover older/equal/newer installed
-   plugin directions and older/equal/newer global directions.
-3. **Recap provisioning:** the CLI product command creates a missing seat
-   subtree under an existing rig, writes `RECAP.md`, then a second write moves
-   its predecessor into `recap-superseded/`. Missing rigs, unsafe segments, and
-   symlinked topology namespaces all fail without creating the target.
-
-The causal base failures are retained in `.evidence/S6-RED-FIRST.md`.

.evidence/S6-HERMETICITY-MINI-SPEC.md

@@ -1,21 +0,0 @@
-# S6 — Hermeticity guards
-
-## Intent
-
-Make daemon startup and recap deposit fail or proceed from explicit authority, never from an ambient path accident: an implicit database may not escape its resolved OpenRig home, an older bundled plugin may not overwrite newer or unversioned installed/canonical content, and a valid topology rig may accept a first recap even when its seat directory was never provisioned.
-
-## Mini-requirements
-
-1. `resolveDaemonDbPath` resolves the implicit database and `OPENRIG_HOME` through the filesystem. It throws before database open when the implicit database resolves outside the resolved home. An explicit non-empty `OPENRIG_DB` remains the deliberate split-path override and is returned unchanged.
-2. Plugin vendoring reads the bundled and installed plugin manifest versions before replacing an existing plugin tree. Only a strictly newer bundled version may replace versioned installed content; equal, older, malformed, or unversioned-existing authority never gets overwritten silently.
-3. Global skill projection carries a plugin-version marker. It may create an absent target or upgrade a target marked with an older plugin version. It must not overwrite equal/newer marked content or a pre-existing unversioned target (including a symlinked shared canon directory).
-4. `rig context recap-write` validates rig/seat as safe path segments, requires the addressed rig directory to exist, and recursively provisions the missing seat directory before calling the existing recap store. A nonexistent rig still fails loud and leaves no tree behind.
-5. Changes stay inside the S6 reserved source/test territory. No daemon restart, live projection write, push, or PR.
-
-## Proof contract
-
-- [ ] An implicit `openrig.sqlite` symlink escaping `OPENRIG_HOME` fails RED on the base and throws GREEN; ordinary implicit home-local and explicit split paths remain supported.
-- [ ] Older/equal bundled plugin content cannot replace newer/equal installed content; a strictly newer bundle upgrades an older marked install.
-- [ ] An older/equal global skill projection cannot overwrite newer/equal marked canon, and an unversioned existing target is left byte-identical; an absent/older marked target installs/upgrades.
-- [ ] `recap-write` succeeds when the rig exists but its seat directory does not, and still refuses a nonexistent rig plus unsafe path segments without creating them.
-- [ ] Focused tests pass from the candidate worktree, TypeScript passes, and the worktree self-check proves `@openrig/daemon` resolves to this worktree before any package-level test is trusted.

.evidence/S6-IMPLEMENTATION-PRD-before.md

@@ -1,50 +0,0 @@
----
-id: OPR.0.5.4.8
-slice: 08-hermeticity-guards
-mission: release-0.5.4
-status: intent
-stage: wip
-created: 2026-08-26
----
-
-<!-- ELASTIC MIDDLE (three-capture-points doctrine): the SDLC fixes exactly
-     three capture points — intent → proportional structured requirement →
-     proof. Everything between is ELASTIC. For a small slice the
-     mini-requirements below may BE the whole PRD; add depth only where the
-     work demands it. The scaffold must not mint ceremony.
-     Conventions SSOT: docs/reference/sdlc-conventions.md (installed: $OPENRIG_HOME/reference/sdlc-conventions.md) -->
-
-# Slice 08 — S6 — Hermeticity Guards
-
-## Intent
-
-[The recorded intent, verbatim — kept in sync with the slice README.]
-
-## Mini-requirements
-
-1. [The concise one-glance requirement tier — this is where approval starts.]
-
-## Proof contract
-
-[MIRRORED 2026-08-26 by the workspace author (dev-planner, desk hygiene row 2ff03ab2), per
-the standing mirror rule (slice-06/0.5.3 precedent): SPEC.md is CANONICAL; the proof-pairing
-tool reads THIS file's exact `## Proof contract` section, so the SPEC promises are mirrored
-ITEM-EXACT below — this banner is the only permitted delta. Divergence in the items is a
-defect — fix it, never pick a winner silently.]
-
-- [ ] DB-OUTSIDE-HOME LOUD: RED-first (today it proceeds silently); after — the mismatch
-      fails loud naming both resolved paths; the deliberate-override path works; a
-      legitimate explicit split-path config still runs (both directions evidenced).
-- [ ] NO SILENT CANON ROLLBACK: RED-first with an older-versioned scratch install against
-      newer shared canon; after — the vendor step refuses/skips per the authority rule and
-      says so; a legitimate newer-over-older vendor still lands.
-- [ ] RECAP-WRITE PROVISIONS: RED-first on a valid seat with no recap directory (today it
-      fails); after — the write succeeds via supported provisioning, and the provisioned
-      layout matches the recap store's contract (superseded-chain intact).
-- [ ] EFFECT EVIDENCE, NOT MESSAGES: each guard's proof includes the on-disk effect (the DB
-      actually refused/used, the canon bytes actually unchanged/updated, the recap file
-      actually written) — never a success message alone.
-
-## Notes (elastic)
-
-[Design, seams, risks, sequencing — only as much as the slice needs.]

.evidence/S6-RED-FIRST.md

@@ -1,44 +0,0 @@
-# S6 RED-first receipt
-
-Base: `7e6bedda754a07c34be9f51a54032196d062a1d1`
-Runtime: Node `v22.23.1`
-Worktree package self-check:
-
-```text
-DAEMON_SOURCE=/private/tmp/s6-hermeticity-guards/packages/daemon
-DAEMON_LINK=/private/tmp/s6-hermeticity-guards/packages/daemon
-```
-
-## DB + plugin authority RED
-
-Command:
-
-```bash
-npx vitest run packages/daemon/test/daemon-db-path.test.ts packages/daemon/test/plugin-vendor-service.test.ts
-```
-
-Base result extracted from the first three-file run: 6 causal failures.
-
-- implicit database symlink escaping resolved `OPENRIG_HOME` did not throw;
-- older bundled plugin overwrote newer installed bytes;
-- equal-version bundled plugin overwrote different installed bytes;
-- bundled global projection overwrote an unversioned existing canon target;
-- newer bundled projection did not advance the target version marker;
-- older bundled projection overwrote a newer marked target.
-
-The strict-newer upgrade pin already passed on base because the old implementation overwrote unconditionally; its opposite-direction tests establish the missing authority rule.
-
-## Recap provisioning RED
-
-The first CLI run was indeterminate because the daemon package export had not been built. After `npm run build -w packages/daemon` completed, this command exercised the product path:
-
-```bash
-npx vitest run packages/cli/test/context-recap-write.test.ts
-```
-
-Result: 2 causal failures / 3 preservation passes.
-
-- a valid existing rig with a missing seat directory failed instead of provisioning it;
-- an unsafe seat segment reached path resolution instead of being rejected as unsafe.
-
-The existing write/supersession behavior, missing-rig refusal, and addressability gate all passed.

.evidence/SPEC-before-F4-amendment.md

@@ -1,110 +0,0 @@
----
-id: OPR.0.5.4.6
-slice: 06-delivery-honesty
-mission: release-0.5.4
-status: intent
-stage: wip
-verified: 2026-08-26 against PLANNING.md Wave 1 S3 + the S2 lock record (see Evidence)
-created: 2026-08-26
-approved-spec-by: orch-advisor@v-openrig-build
-approved-spec-at: 2026-08-26T06:51:37.788Z
-locked-artifacts:
-  - name: Implementation PRD
-    path: IMPLEMENTATION-PRD.md
-    kind: spec
-provenance: transport:v1
-approved-spec-priors: 2
----
-
-# Slice 06 — S3 — Delivery Honesty End-to-End
-
-Workspace authored 2026-08-26 by dev-planner (desk hygiene row 2ff03ab2) so the slice has a
-SPEC home and a proof/ scaffold before dispatch. Per the wave-SDLC ruling this locks by desk
-on frozen hashes, no review round. S3 dispatches SERIALIZED BEHIND S2 (same file territory).
-
-BASE REFRESH 2026-08-26 (re-stamp chain, dev-driver row e93d3989 — references only, ZERO
-scope change): S2 has FOLDED; the S3 build base is clean main `886c3f1d5` (the S2 fold),
-S2-base preservation verified by dev-driver at that base (transport-routes 43/43, cli
-send/broadcast 68/68) before any S3 asset. RED proof assets exist as a test-only commit
-`e347f84ce` (send.test.ts sha256 9d038e33…, RED run capture
-.evidence/RED-s3-staged-vs-consumed-at-886c3f1d5.txt sha256 2b4e732b… — PROOF-1 and
-PROOF-3 RED at clean-main bytes, PROOF-2 pin green). Territory reading confirmed consistent
-with the locked text: session-transport.ts is outside mini-req 3's territory, so the
-staged-vs-consumed discrimination lives CLIENT-SIDE in send.ts, composing the primitives
-walk.ts already uses (capture evidence + submitOnly submit) — this was the locked design's
-meaning, now stated explicitly. The prior frozen SPEC hash 8b652113… was reproduced
-byte-exact by this author from the current file minus the 06:37Z desk-stamp frontmatter —
-the earlier divergence dev-driver flagged was the approval stamp alone, no content drift.
-
-## Intent
-
-"Sent" must mean CONSUMED, never merely typed (PLANNING.md Wave 1 S3; absorbs carried slices
-02 delivery-verify-honesty + 04 transport-sender-trust). `send --verify` detects
-staged-unsent by EFFECT — the walk verb's consumption-verification + turn-closure pacing
-pattern, already shipped in 0.5.3, generalized to plain sends. Evidence class: the
-send-staging specimens (2 in one mechanics run) + the T1 walk saga; the interim discipline
-("text sitting AT the prompt = staged, not consumed; the fix is one Enter, not a re-send")
-becomes product behavior instead of seat lore.
-
-## Mini-requirements
-
-1. `send --verify` distinguishes CONSUMED from STAGED by effect (the pane's post-send state,
-   the walk pattern generalized), never by transport return codes — whose negative signals
-   are measured-unreliable.
-2. A staged-unsent detection reports itself honestly (names what was checked and what was
-   observed, to the S1 error bar) and the remedy surface is the existing submit path — no
-   re-send, no double delivery.
-3. Territory (inherits S2's exclusive files, serialized behind S2's fold):
-   packages/daemon/src/routes/transport.ts, packages/cli/src/commands/send.ts,
-   packages/cli/src/commands/broadcast.ts, and their focused tests only.
-4. Seams held: S2's unknown-sender behavior is the base and is not re-opened; the door07
-   evidence chain (row 53f6aed1) remains citable here — this slice is where
-   sent-means-consumed lives.
-
-## Proof contract
-
-- [ ] STAGED-UNSENT DETECTED BY EFFECT: a send whose text lands AT the prompt (staged, not
-      consumed) is reported as such by `send --verify` — RED-first against the current bytes
-      (today "sent" is reported), GREEN after, with the discriminating evidence being pane
-      effect, not a transport return.
-- [ ] CONSUMED MEANS CONSUMED: a genuinely consumed send verifies positively; the two
-      outcomes are never interchangeable and the staged report names what was checked.
-- [ ] NO DOUBLE DELIVERY: the staged remedy is the submit path (the single Enter), proven to
-      deliver exactly once; a blind re-send is never the product's suggestion.
-- [ ] INTERIM LORE RETIRED: the seat-discipline note ("staged-at-prompt, fix is one Enter")
-      is demonstrated unnecessary by the product's own report; retirement recorded in the
-      guidance that taught it, cited by path.
-
-## Repro
-
-Send text to a seat whose pane leaves it staged at the prompt (the send-staging class):
-`send --verify` today reports sent/verified while the recipient never consumed the text.
-
-## Expected
-
-The verify path reports staged-vs-consumed truthfully by effect, names its evidence, and
-points at the single-submit remedy.
-
-## Actual
-
-"Sent" is reported for staged text; the discrimination lives only in seat lore (capture and
-look), and blind re-sends double-deliver.
-
-## Impact
-
-Every cross-seat wake and instruction; the T1 walk saga and two same-run staging specimens
-measured the cost in 0.5.3.
-
-## Evidence
-
-- PLANNING.md Wave 1 S3 (the defining entry, read whole by the author 2026-08-26).
-- The S2 dispatch baton (row 6712d850) fixing the shared territory and the serialization
-  rule; the S2 locked spec (OPR.0.5.4.3) as the base whose behavior this slice must not
-  re-open.
-- 0.5.3 record: the send-staging specimens and the T1 walk saga (mission release-0.5.3
-  NOTES.md §6); the walk verb's shipped consumption-verification pattern (delivered
-  piece-by-piece with per-piece verification) as the generalization source.
-
----
-
-> **How you work this slice (SOP):** conventions SSOT: `docs/reference/sdlc-conventions.md` (installed: `$OPENRIG_HOME/reference/sdlc-conventions.md`); full flow: the `mission-slice-sop` skill. Author intent → mini-requirements + proof contract → plan-lock (`rig scope slice approve --scope spec`) → build the locked set → QA → `rig proof add … --evidences` → proof-lock (`--scope delivery`). A slice is **not done** until every proof-contract item has evidence.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,60 @@
+name: Bug report
+description: Something OpenRig does is wrong, or a command fails
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks. Include a small reproduction and the relevant versions.
+        This report will be public. Remove API keys, tokens, private prompts, personal details and private paths from commands, logs and configuration.
+        For a suspected vulnerability, follow our [security policy](https://github.com/mvschwarz/openrig/security/policy) instead of posting details here.
+  - type: input
+    id: version
+    attributes:
+      label: OpenRig version
+      description: Output of `rig --version`
+      placeholder: 0.5.14 (2edc1b7a)
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: OS, Node and tmux versions
+      placeholder: macOS 15.6, Node 22.22.1, tmux 3.5a
+    validations:
+      required: true
+  - type: dropdown
+    id: harness
+    attributes:
+      label: Harnesses involved
+      multiple: true
+      options:
+        - None / not sure
+        - Claude Code
+        - Codex
+        - Pi / Oh My Pi
+        - Other (say which below)
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: What you ran and what happened
+      description: The command(s), relevant redacted output, and what you expected instead. Paste text where you can; screenshots are useful for visual issues.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: state
+    attributes:
+      label: Instance state that might matter
+      description: Fresh install or upgrade? Include only relevant redacted lines from status output or your rig spec; do not upload full transcripts, credentials or your instance directory.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and Discussions for this.
+          required: true
+        - label: I am on the latest published version, or I said which version above.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Ask a question
+    url: https://github.com/mvschwarz/openrig/discussions/categories/q-a
+    about: Setup, usage and "is this expected" questions go to Discussions Q&A.
+  - name: Share an idea or a setup
+    url: https://github.com/mvschwarz/openrig/discussions
+    about: Ideas and Show and tell live in Discussions.
+  - name: Documentation
+    url: https://openrig.dev/docs
+    about: Getting started, CLI reference, configuration and troubleshooting.
+  - name: Security report
+    url: https://github.com/mvschwarz/openrig/security/policy
+    about: Read how to arrange a private report. Do not include vulnerability details in public issues.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,32 @@
+name: Feature request
+description: Something you want OpenRig to do that it does not
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For open-ended ideas or "how should this work" questions, [Discussions › Ideas](https://github.com/mvschwarz/openrig/discussions/categories/ideas) is the better place. Use this form when you can name the outcome you want.
+        This request will be public; use examples without credentials, private prompts or personal details.
+  - type: textarea
+    id: outcome
+    attributes:
+      label: What are you trying to do, and what stops you today?
+      description: Describe the situation, not the solution. One real example beats a general case.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What would you like OpenRig to do?
+      description: A command, a setting, a behaviour. Rough is fine.
+    validations:
+      required: true
+  - type: textarea
+    id: workaround
+    attributes:
+      label: How do you handle it now?
+  - type: input
+    id: version
+    attributes:
+      label: OpenRig version
+      placeholder: 0.5.14

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+<!-- Thanks for the PR. Three short answers are all a reviewer needs. -->
+
+## What a user gets
+
+<!-- One or two sentences: the behaviour before, the behaviour after. Link the issue if there is one. -->
+
+## How you verified it
+
+<!-- What you actually ran and saw, and which revision/local changes you tested. The documented checks are `npm run build`, `npm test`, and `npm run lint`; say what you could not run. Redact credentials and private information from logs or screenshots. -->
+
+## Anything you were unsure about
+
+<!-- Design choices, edge cases you did not cover, places a reviewer should look hardest. Empty is a fine answer. -->
+
+## If this is security-related
+
+<!-- Exploitable? Report it privately first (SECURITY.md). Otherwise: how does this go wrong for someone using OpenRig as designed (your own machine or a trusted private network), with evidence? Who causes it, and how do they reach the install? What does the change cost everyone else? See CONTRIBUTING.md. -->
+
+- [ ] One concern per PR; no version bump; no `CHANGELOG.md` edit
+- [ ] Tests added or updated where the change is testable
+- [ ] I listed the checks I ran, their results, and any checks I could not run

.github/SUPPORT.md

@@ -0,0 +1,17 @@
+# Getting help with OpenRig
+
+- **Docs:** https://openrig.dev/docs — getting started, CLI reference, configuration,
+  troubleshooting. An index linking to agent-friendly documentation is at
+  https://openrig.dev/llms.txt.
+- **Agents helping a user:** read [docs/reference/help.md](../docs/reference/help.md), or run `rig context get help`.
+- **Questions:** [Discussions › Q&A](https://github.com/mvschwarz/openrig/discussions/categories/q-a).
+- **Bugs:** [open an issue](https://github.com/mvschwarz/openrig/issues/new/choose) with the bug
+  template. Include `rig --version`, your OS and Node versions, and relevant redacted command output.
+  Reports are public: remove credentials, private prompts and personal information.
+- **Ideas and setups:** [Ideas](https://github.com/mvschwarz/openrig/discussions/categories/ideas)
+  and [Show and tell](https://github.com/mvschwarz/openrig/discussions/categories/show-and-tell).
+- **Videos:** https://www.youtube.com/@openrig
+- **Security:** see [SECURITY.md](../SECURITY.md); please report privately.
+
+We aim to acknowledge issues and pull requests within one day. A substantive PR review decision
+within seven days is a target, not a guaranteed deadline. Details in [CONTRIBUTING.md](../CONTRIBUTING.md).

.github/workflows/portability-report.yml

@@ -0,0 +1,33 @@
+name: Portability report
+
+# Lists lines a pull request adds that contain values tied to one machine, network or account
+# (credentials, home paths, temporary paths, network addresses, email addresses). Findings never
+# fail the job; the author reads the report and decides what to change. An operational error (for
+# example a git failure) does fail it. The repository is public, so this summary lists file and
+# line only; authors see the matched text when they run the report locally or on push.
+# See scripts/portability-report.mjs.
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  portability-report:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Report added lines with machine-specific values
+        run: >
+          node scripts/portability-report.mjs
+          --from ${{ github.event.pull_request.base.sha }}
+          --to ${{ github.event.pull_request.head.sha }}
+          --locations-only
+          --out "$GITHUB_STEP_SUMMARY"

.github/workflows/tests.yml

@@ -0,0 +1,139 @@
+name: Tests
+
+# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
+# list each published package would contain. Each suite is its own job so one failure does not
+# hide the others. No provider credentials or operator configuration are supplied.
+# Package suites deny external networking; scenario runtime has no external route.
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-package:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Record the published file list of each package
+        run: |
+          set -euo pipefail
+          mkdir -p pack-lists
+          for p in cli daemon tui; do
+            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
+              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
+              | sort > pack-lists/$p.txt
+            echo "$p: $(wc -l < pack-lists/$p.txt) files"
+          done
+      - uses: actions/upload-artifact@v4
+        with:
+          name: pack-lists
+          path: pack-lists/
+
+  typecheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+
+  repo-checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run test:repo
+
+  package-tests:
+    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
+    # file-inode behaviour and release tags.
+    runs-on: macos-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        package: [daemon, cli, tui, ui]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: brew install tmux
+      - run: npm ci
+      - name: Build the packages the tests import
+        run: npm run build
+      - name: Run the suite without ambient credentials or external network
+        run: |
+          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
+          suite_root=$(cd "$suite_root" && pwd -P)
+          mkdir -p "$suite_root/home" "$suite_root/bin"
+          # Same system bytes, nonprivileged mode; no system file is changed.
+          /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
+          # Only this job's temporary sockets (including tmux) are reachable.
+          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
+            CI=true TERM=xterm-256color \
+            sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
+            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
+          set -euo pipefail
+          node scripts/ci-macos-process-probe.mjs
+          # The production readers use bare ps. Select real system bytes only after
+          # self/owned-child observation and network/IPC confinement are proved.
+          export PATH="$TMPDIR/bin:$PATH"
+          test "$(command -v ps)" = "$TMPDIR/bin/ps"
+          exec npm run test -w "packages/$1"
+          SUITE
+
+  installed-scenario:
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - name: Installed package, daemon restart, and seeded durability failure
+        run: bash scripts/run-pr-scenarios.sh
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: installed-scenario-evidence
+          path: dist/pr-scenarios/
+          if-no-files-found: error

.gitignore

@@ -36,3 +36,6 @@ demo/proof/
 # OPR.0.5.3.7 R2 — the shipped context-pack projection is DERIVED AT PACKAGE TIME
 # (scripts/generate-context-packs.mjs), never committed or edited in place.
 packages/daemon/context-packs/
+
+# Internal build receipts; never commit
+/.evidence/

CHANGELOG.md

@@ -8,6 +8,358 @@ deprecations, and behavioral changes. Breaking changes are called out explicitly
 
 ---
 
+## [0.6.3]
+
+- Recognize running managed Claude Code seats behind OpenRig's shell wrappers
+  using pane lineage, foreground process and native session identity checks.
+  This repairs the 0.6.2 messaging refusal reported by
+  [@dmelo](https://github.com/dmelo) in
+  [#197](https://github.com/mvschwarz/openrig/issues/197)
+  ([#220](https://github.com/mvschwarz/openrig/pull/220)).
+- Clean up unusable snapshot helpers when their ownership is proven, instead
+  of accumulating them on repeated attempts. Thanks to
+  [@z4cc](https://github.com/z4cc) for
+  [#188](https://github.com/mvschwarz/openrig/issues/188)
+  ([#189](https://github.com/mvschwarz/openrig/pull/189)).
+- Keep archived duplicate rigs out of seat-reference resolution and preserve
+  another live seat's session and queue work when removing a stale node.
+  Thanks to [@Farkinell](https://github.com/Farkinell) for
+  [#174](https://github.com/mvschwarz/openrig/issues/174)
+  ([#181](https://github.com/mvschwarz/openrig/pull/181)).
+
+- Protect proof media from artifact writes: reject binary artifact bodies and
+  require an explicit `--replace` to overwrite an existing Markdown artifact
+  ([#177](https://github.com/mvschwarz/openrig/pull/177)). Repository script tests
+  also run serially to prevent interference from shared build outputs
+  ([#221](https://github.com/mvschwarz/openrig/pull/221)).
+
+See [0.6.3 release notes](docs/releases/v0.6.3.md) for the verification limits.
+Source regression coverage does not establish installed Claude/Fedora delivery.
+
+## [0.6.2]
+
+- Start with two Claude Code agents, two Codex agents, or a Claude owner and
+  Codex checker, using the same first-project task and review path. Agent-guided
+  setup recommends a scoped `rig` command allowance after your explicit choice;
+  broader permissions remain separate
+  ([#147](https://github.com/mvschwarz/openrig/pull/147)).
+- Install schema-version-2 bundles into `--target` and launch from those retained
+  files. Local CLI bundle paths resolve from your working directory; conflicting
+  target files are preserved ([#146](https://github.com/mvschwarz/openrig/pull/146)).
+  Without `--target`, `rig up <file>.rigbundle` installs into your current directory, so run it from the project folder you want.
+- Refuse message delivery into a bare shell where an agent runtime should be
+  running ([#150](https://github.com/mvschwarz/openrig/pull/150), fixes
+  [#142](https://github.com/mvschwarz/openrig/issues/142)).
+- Preserve the named target during managed launches after a tmux/host restart,
+  instead of confusing it with an old bare pane binding; existing identity checks
+  remain. Thanks to [@diaztunjano](https://github.com/diaztunjano) for reporting
+  [#141](https://github.com/mvschwarz/openrig/issues/141), addressed by
+  [#151](https://github.com/mvschwarz/openrig/pull/151).
+- Repair self-host sender identity, tmux window parsing, Codex hook-path
+  canonicalization, Pi input editing, TUI health display and restore diagnostics;
+  carry runtime hints to Herdr and allow configured Anthropic endpoint forwarding.
+  See the [community fixes and credits](docs/releases/v0.6.2.md#community-fixes).
+
+See [0.6.2 release notes](docs/releases/v0.6.2.md) for usage and compatibility.
+Installed first-use and reboot/power-loss verification remain pending; these
+source changes do not establish those outcomes.
+
+## [0.6.1]
+
+- One version-matched agent help guide: `rig context get help`, also available
+  inside the installed package when the CLI cannot run. It links setup, restart,
+  permissions and instance guidance, with a support route at hello@openrig.dev
+  ([#113](https://github.com/mvschwarz/openrig/pull/113)).
+- `rig view show execution --project <catalog-id> --mission <mission>` selects
+  a catalogued project's missions. Thanks to
+  [@dajiaohuang](https://github.com/dajiaohuang)
+  ([#105](https://github.com/mvschwarz/openrig/pull/105)).
+- Recognize the Codex `»` conversation prompt during startup/resume checks,
+  including after a dismissed hook-review panel. Unresolved menus remain gates.
+  Thanks to [@dajiaohuang](https://github.com/dajiaohuang)
+  ([#111](https://github.com/mvschwarz/openrig/pull/111)).
+- Repair the bundled Vault skill's frontmatter and check shipped skill headers
+  ([#115](https://github.com/mvschwarz/openrig/pull/115)); remove historical
+  development evidence from the public source tree
+  ([#118](https://github.com/mvschwarz/openrig/pull/118)) and the retired TUI
+  drivability prototype ([#119](https://github.com/mvschwarz/openrig/pull/119)).
+- Run eight PR test jobs, including the UI suite and one installed queue-durability
+  scenario with an intentional failure control
+  ([#117](https://github.com/mvschwarz/openrig/pull/117)). This does not cover all
+  historical scenarios or every platform.
+- Parse SQLite boot timestamps as UTC on non-UTC hosts so current identity and
+  context readings are compared with the correct generation start time. Thanks
+  to [@Coder8124](https://github.com/Coder8124)
+  ([#124](https://github.com/mvschwarz/openrig/pull/124)).
+- Recognize headerless Codex conversations with custom status-line field order
+  and mixed-case model names ([#125](https://github.com/mvschwarz/openrig/pull/125));
+  thanks to [@Hexgunner69](https://github.com/Hexgunner69) for the report and
+  [@Aummadour](https://github.com/Aummadour) for regression cases. The separate
+  stale restore-warning issue is not fixed by this change.
+- Resolve a linked worktree's Git metadata directories for Codex fresh launches
+  instead of passing its `.git` file as a directory
+  ([#126](https://github.com/mvschwarz/openrig/pull/126)); thanks to
+  [@mgall-ibizdigital](https://github.com/mgall-ibizdigital) for the report and
+  suggested approach.
+
+See [0.6.1 release notes](docs/releases/v0.6.1.md) for changes and compatibility
+limits. Slack manifest/setup assistance and Rig Stream classification remain
+experimental; no new validation of those experiments is claimed.
+
+## [0.6.0]
+
+- **Breaking:** OpenRig requires Node.js 22 or 24 and uses better-sqlite3 13.
+  Node 20 is no longer supported, and the install check refuses it; Node 26 is
+  untested. Switch Node, then reinstall the CLI; existing
+  data is migrated in place. See [Moving off Node 20](README.md#moving-off-node-20).
+  Thanks to [@jimallen](https://github.com/jimallen) for reporting the Node 26
+  install failure and proposing the upgrade ([#16](https://github.com/mvschwarz/openrig/pull/16)).
+- Choose permissions per seat for future launches with
+  `rig seat set-permissions <seat> --mode <mode> --reason <text>`. Codex
+  `full_bypass` now also sets `-a never`; Claude Code modes such as `auto` are
+  accepted only when the managed executable supports them. Rig-level verbs move
+  to `rig policy permissions …`, with the old verbs kept as aliases. Thanks to
+  [@DoowanKang](https://github.com/DoowanKang) ([#30](https://github.com/mvschwarz/openrig/issues/30))
+  and [@djogss](https://github.com/djogss) ([#33](https://github.com/mvschwarz/openrig/issues/33)).
+- Protect a seat where you type by hand with `rig seat set-typing-guard`. While it
+  is on, automatic messages and wakes are held instead of typed in; the default is
+  unchanged. Thanks to [@some-marketing](https://github.com/some-marketing)
+  ([#48](https://github.com/mvschwarz/openrig/issues/48)).
+- Experimental: `rig slack manifest` prints the Slack app manifest offline, with a
+  prefilled create-app link, and a new setup guide describes the manual steps.
+  Creating the app remains a step you do in Slack, and the steps have not been
+  confirmed against a real app creation. The existing Slack connector is not
+  experimental.
+- Open a whole rig in Herdr from the TUI (`term ▸ rig <name>`), up to 16 seats per
+  tab in a workspace named after the rig; the empty starting tab is closed only
+  when that is confirmed safe. Thanks to [@shintaii](https://github.com/shintaii)
+  ([#26](https://github.com/mvschwarz/openrig/issues/26)).
+- Pi seat activity reports carry the occupant generation and are accepted only
+  for the seat's current occupant. Thanks to
+  [@DoowanKang](https://github.com/DoowanKang) ([#29](https://github.com/mvschwarz/openrig/issues/29)).
+- The kernel starter summary identifies the library preview and explains automatic
+  runtime-variant selection. Thanks to [@tgrundtvig](https://github.com/tgrundtvig)
+  ([#21](https://github.com/mvschwarz/openrig/issues/21)).
+- Codex seats launch with `--no-daemon` when supported. Thanks to
+  [@reisalbuquerque](https://github.com/reisalbuquerque) ([#69](https://github.com/mvschwarz/openrig/issues/69)).
+- Missions without a `metadata` block no longer fail the readiness reader. Thanks
+  to [@shravansumanthanan](https://github.com/shravansumanthanan) for the fix and
+  [@kainne44](https://github.com/kainne44) for the report
+  ([#72](https://github.com/mvschwarz/openrig/issues/72)).
+- Experimental and optional, off by default: a classifier seat can have Jev,
+  through OpenRouter, label Rig Stream observations. Check, turn on or turn off
+  with `rig project experimental status|enable|disable --config <file>`, then run
+  one bounded foreground `rig project wake … --experiment <file>`. Labels are
+  advisory, with no accuracy or reliability claim, and the feature may be
+  incomplete. See [stream classification](docs/reference/stream-classifier-worker.md).
+- Report problems with either experiment through a
+  [GitHub issue](https://github.com/mvschwarz/openrig/issues/new/choose) or a pull
+  request ([CONTRIBUTING.md](CONTRIBUTING.md)).
+
+Includes [#77](https://github.com/mvschwarz/openrig/pull/77),
+[#84](https://github.com/mvschwarz/openrig/pull/84) by
+[@mvdpoel](https://github.com/mvdpoel), [#91](https://github.com/mvschwarz/openrig/pull/91)
+and [#94](https://github.com/mvschwarz/openrig/pull/94).
+
+Release preparation: [#109](https://github.com/mvschwarz/openrig/pull/109).
+An ordinary candidate-tarball install with real postinstall passed on fresh
+macOS 15 ARM64 / Node.js 22.22.1, including SQLite 13, all 89 migrations,
+write/reopen and unauthenticated daemon startup/shutdown. Fresh Node 24 install
+and authenticated native fresh/resume/fork permission enforcement were not
+completed. See the [verification scope](docs/releases/v0.6.0.md#verification-scope)
+and [known limitations](docs/releases/v0.6.0.md#known-limitations). The final
+artifact will be separately bound to the merged release commit.
+
+## [0.5.17]
+
+- Install the CLI with Bun as well as npm: `bun add -g @openrig/cli`. The package
+  no longer depends on the unpublished `@openrig/daemon`; it imports the daemon
+  copy it already ships, which also makes the package smaller. OpenRig still runs
+  on Node.js, and Bun may block the package's postinstall check. Thanks to
+  [@drewpayment](https://github.com/drewpayment) for reporting this
+  ([#66](https://github.com/mvschwarz/openrig/issues/66)).
+
+Includes [#68](https://github.com/mvschwarz/openrig/pull/68). The Node support
+range and SQLite version are unchanged.
+
+## [0.5.16]
+
+- Let a rig write Claude Code's managed instruction blocks to `CLAUDE.local.md`
+  instead of a tracked `CLAUDE.md`, with `managed_blocks: { claude-code: CLAUDE.local.md }`.
+  The default stays `CLAUDE.md`, and Codex stays on `AGENTS.md`. Blocks already
+  written to `CLAUDE.md` are not moved; remove them by hand after switching.
+  Thanks to [@hvpaiva](https://github.com/hvpaiva) for reporting and proposing
+  this ([#25](https://github.com/mvschwarz/openrig/issues/25)).
+- Add an advisory portability report for pull requests. It lists added lines
+  that contain machine-, network- or account-specific values. Findings never
+  fail the check; operational errors, such as a git failure, still do.
+- Show badges and a short demo of agents working in the README.
+
+Includes [#54](https://github.com/mvschwarz/openrig/pull/54) and
+[#56](https://github.com/mvschwarz/openrig/pull/56) by
+[@mvschwarz](https://github.com/mvschwarz). The Node support range and SQLite
+version are unchanged.
+
+## [0.5.15]
+
+- Recognize Codex through shell and Node launchers during startup and recovery,
+  while keeping uncertain process identity visible.
+- Skip recognized Codex update notices without installing provider updates, and
+  give clearer startup recovery guidance, including `rig up <name> --existing`.
+- Add the OpenRig Software Factory recipe and worked example for continuing
+  reviewed work, with incremental team growth using `rig grow`.
+- Guide agents through user-chosen command permissions, preserving existing rules
+  and explaining project versus user scope. Permission defaults are unchanged.
+- Explain provider hooks, workspace trust and other machine changes before the
+  first launch.
+- Show Pi replies and tool progress, retain managed OpenRig context in shell
+  tools, and report bounded provider errors without exhausted-retry duplicates.
+- Submit pasted Pi messages explicitly and handle input beyond the terminal's
+  canonical buffer limit, including cancellation and oversized-input recovery.
+- Add a guarded retry for an added seat whose first startup failed during resource
+  projection; retain its complete original configuration for recovery.
+
+Pi support remains qualified and supervised: controlled coding and continuity
+were verified, but ordinary useful-task completion and unattended teamwork remain
+unverified. Shipped permission defaults, the Node support range and SQLite version
+are unchanged; project work-policy features are outside this release.
+
+Includes [#37](https://github.com/mvschwarz/openrig/pull/37) by
+[@danielkuykendall23-boop](https://github.com/danielkuykendall23-boop), and
+[#38](https://github.com/mvschwarz/openrig/pull/38),
+[#39](https://github.com/mvschwarz/openrig/pull/39),
+[#45](https://github.com/mvschwarz/openrig/pull/45) and
+[#46](https://github.com/mvschwarz/openrig/pull/46) by
+[@mvschwarz](https://github.com/mvschwarz).
+
+**Known compatibility limitation:** on macOS arm64 with Node 24, SQLite dependency
+installation can fail when a suitable prebuilt binary is unavailable, and
+compiler-built SQLite has also shown runtime cleanup failures. Use Node 22 on
+that platform for now; the declared Node support range is unchanged.
+See [the release notes](docs/releases/v0.5.15.md) for starting commands and guidance.
+
+## [0.5.14] - 2026-09-14
+
+VM inspection was accepted: generally zero-to-two-second loading with
+occasional timeouts, formatting, icon colors and default views. This is an
+observed result, not a general latency or availability guarantee. The completed
+single-consumer Slack/phone exercise remains evidence for unchanged notifications.
+
+- Enter a confirmed running rig directly, with responsive Help, Skip and Local
+  during slow or unverified startup.
+- Keep the navigator and labelled useful content during page/rig changes, slow
+  reads and failures; preserve scope identity, passive prior content and confirmed
+  removal semantics. Read the selected rig before unrelated fleet details.
+- Send complete bounded human briefs with related thread detail, distinguish
+  quiet FYIs from decisions, and retain delivery/reply correlation.
+- Find instance-wide Human requests and delivered Updates in Feed; open Health,
+  Configuration and Connections under System, with six top-level entries.
+- Browse Feed categories, explicitly expand Specs kinds and Derived terminal
+  views, and find Saved views without expanding the whole catalog.
+- Read mission outcomes, current or planned owner, blockers and next dependencies
+  above slice boxes at both terminal widths. Native accepted judgments drive
+  completion; assigned or reopened work and mission lifecycle remain distinct.
+- Reduce repeated terminal inventory work while preserving saved-view preview
+  and explicit Herdr Open; no general latency improvement is claimed.
+- Keep primary queue facts readable when optional blocker descriptions fail;
+  bound fleet reads across stages and avoid duplicate policy/receipt read work.
+- Reduce restore/startup inventory scans with selective event indexes, preserving
+  history and projection results; private replay is not a live latency guarantee.
+- Preserve nullable identity provenance during queue-history archival. Shared
+  history, RECENT and OWNER/receipt readers now include archived records;
+  unknown historical provenance stays null rather than being reconstructed.
+
+Root, CLI, daemon and web UI are `0.5.14`; terminal TUI remains `0.1.0`.
+Migration head advances to `084_inventory_event_indexes`, following review read
+indexes in 083, archive identity provenance in 082 and explicit human-intent fields
+in migration 081. Private installed review and controlled notification checks
+retain their exact candidate and
+runtime attribution. See [the release notes](docs/releases/v0.5.14.md) for
+operator guidance and verification limits.
+
+Known limitations: the inherited CLI health-check deadline can reject a queue
+command before its request is sent; that defect and occasional server delay are
+not fixed here. Same-candidate recovery did not establish durable responsiveness.
+Bundled Workflow Specs can disappear from discovery when an upgrade changes the
+install directory; that fix is explicitly deferred beyond 0.5.14. Recorded
+shutdown/config-preservation uncertainties and the prior recorder-write failure
+remain disclosed.
+
+## [0.5.13] - 2026-09-10
+
+**Status**: release candidate, unpublished. Exact-cut substance review,
+release verification and publication remain pending; live adoption is separate.
+
+- Enter the TUI with useful Help, Skip and local intent reading even while
+  the daemon is unavailable or its state is unverified.
+- Choose a project, read its current sources and follow links, then return
+  to the same place without confusing projects that share a name.
+- Separate requests needing human action from updates in ATTENTION, and
+  inspect their source without implying approval.
+- Preview saved or derived terminal views before deliberately opening them;
+  navigate CONFIG, Help and health with readable values at narrow widths.
+- Choose scoped human-led or delegated oversight and retain current context,
+  assessment and action evidence without claiming improved behavior.
+- Update Git-backed context through an explicit merge that preserves local
+  authorship, conflicts and the distinction between selected and consumed bytes.
+
+Root, CLI, daemon and web UI are `0.5.13`; terminal TUI remains `0.1.0`.
+Migration head advances to `080_scoped_operating_posture`. Natural behavioral
+effect remains **UNOBSERVED** and human time cost **UNMEASURED**. The default
+multi-client control-socket limitation remains disclosed and unfixed.
+See [the full release notes](docs/releases/v0.5.13.md) for usage and proof limits.
+
+## [0.5.12] - 2026-09-09
+
+**Status**: release candidate; exact-cut review, final verification and
+publication remain pending.
+
+- Record authorized proof judgments and corrections once; derive affected
+  slice, mission and project readiness with attributable evidence.
+- Inspect authored versus running graphs, deliberately adopt supported
+  revisions, and reconcile ambiguous operations without duplicate work.
+- Discover exception ownership before failure; admit dependency-failure
+  tasks/wakes atomically and recover one occurrence without hiding another.
+- Keep healthy unchanged waits quiet while preserving change-driven wake,
+  bounded recovery and explicit expansion of compact reads.
+- Enter through bare interactive `rig` for normal startup and selective
+  return, preserving conversation history or requesting an explicit fresh start.
+- Browse general instance settings and provenance in CONFIG, with Slack as
+  one subsection and passive, secret-safe inspection.
+
+Root, CLI, daemon and web UI are `0.5.12`; terminal TUI remains `0.1.0`.
+Migration head remains `079_workflow_lifecycle_parallel`. Accepted development
+and native evidence retains its original attribution; release preparation does
+not imply a new human usability study, full-platform run or public adoption.
+See [the full release notes](docs/releases/v0.5.12.md) for operational guidance
+and known limits.
+
+## [0.5.11] - 2026-09-07
+
+**Status**: release candidate; final verification and publication remain pending.
+
+- Start useful repository work with the focused `first-project` owner/checker
+  team and an attachable shared kernel TUI.
+- Inspect workflow owners and waits, declared spec purpose, effective instance
+  configuration, and human connection state in the ordinary TUI.
+- Navigate with command completion, readable Recent activity, and persistent
+  timezone selection. Unverified daemon probes no longer read as confirmed down.
+- Reuse project release profiles that retain both the release ceremony and the
+  actual post-release boundary, independently of successor scope.
+- Preserve context delivery and generation evidence; honor authored startup
+  proof selection; improve exception routing, bounded shutdown receipts,
+  startup child identity, and cross-host origin attribution.
+- Diagnosis `show`/`list --json` now return summaries; use `--full --json`
+  for complete evidence. Queue previews also print an exact full-read command.
+
+Root, CLI, daemon, and web UI are `0.5.11`; terminal TUI remains `0.1.0`.
+Migration head remains `079_workflow_lifecycle_parallel`.
+
+The health-agent experiment remains a POC, and the Herdr journey requires no
+plugin. Neither is a new cold-agent architecture or a plugin/adoption claim.
+See [the full release notes](docs/releases/v0.5.11.md) for operational guidance
+and the retained verification limits.
+
 ## [0.5.7] - 2026-09-01
 
 **Status**: release-cut candidate. Final release-wide verification and public
@@ -155,9 +507,9 @@ Overdue + undelivered become routed findings with derived evidence inline. **Rea
 
 `rig seat handover --source fork:` (carries live context) or `rebuild` (primes from the durable chain and names its priming artifacts). Mid-swap failures record honestly. **Reach for it when:** replacing an occupant — no more dry-run-only planning surface.
 
-#### Reach humans (and the founder) directly through Slack
+#### Reach human decision owners directly through Slack
 
-Gateway running, thread-per-seat, exactly-once inbound reconciliation, escalation loudness (mention) distinct from routine. Humans are addressable members; `rig gateway human` has full fragment-lifecycle verbs. **Reach for it when:** anything must reach the founder — an escalation-class send arrives loud on their phone.
+Gateway running, thread-per-seat, exactly-once inbound reconciliation, escalation loudness (mention) distinct from routine. Humans are addressable members; `rig gateway human` has full fragment-lifecycle verbs. **Reach for it when:** anything must reach a human decision owner — an escalation-class send arrives loud on their phone.
 
 #### Onboard fresh installs without hand-walking
 
@@ -298,13 +650,13 @@ The refocus hook resolves library refs automatically (ref beats file), fails lou
 
 `rig context get` serves expertise packs by path-like ref, e.g. `skills/process/context-engineering`. The old `context-pack:` colon form was removed and the CLI says so.
 
-**Caveat that pack:** it is titled "Traditional Context Engineering — 2024-2025 Snapshot" for a reason — provisional, historical, non-normative by founder ruling. Current OpenRig skills, explicit user rulings, and measured practice outrank it on any conflict.
+**Caveat that pack:** it is titled "Traditional Context Engineering — 2024-2025 Snapshot" for a reason — provisional, historical, non-normative by the project owner's ruling. Current OpenRig skills, explicit user rulings, and measured practice outrank it on any conflict.
 
 ### What to STOP doing (each was correct under 0.5.2 and is wrong now)
 
 1. **STOP copying library content into seat or mission files to compose context.** Compose by ref — addressing means there is no second copy to drift. Nothing catches the copy automatically; it is still a defect by rule.
 2. **STOP treating a `MODEL DIVERGENCE` proclamation as alias noise.** The canonicalize-then-compare fix ended the pinned=fable / effective=claude-fable-5 false-positive class, and the monitor now isolates per-seat throws. A proclamation on this runtime is a real escalation — act on it.
-3. **STOP reading "founder-gated" in tool errors as an authorization wall.** The overstated wording is retired from the scripts; those guards demand explicit paths (e.g. `OPENRIG_SKILL_CANON_ROOT`), not permission. The real founder boundary is exactly: pushes and PRs. Local commits and ordinary apply work never need founder word.
+3. **STOP confusing explicit-path requirements with permission.** The guards described in this release demand explicit paths (e.g. `OPENRIG_SKILL_CANON_ROOT`); that mechanism does not grant authorization. **Historical guidance correction (2026-09-10):** the earlier approval statement was project-specific, not a universal rule. Current project and mission authority determines whether local commits, apply operations, pushes or PRs require approval.
 4. **STOP hand-placing evidence or trusting a placeholder PRD as the proof contract.** `rig proof add` pairs evidence to the contract, and a pristine scaffold PRD can never silently become that contract: the authored SPEC serves with a named advisory (`contractSource` in the echo tells you which source bound).
 
 ### Landed but not yet drivable (recorded so nobody reaches for it)
@@ -719,7 +1071,7 @@ Building on the v0.4.8 permission-policy foundation, v0.5.0 ships the built-in p
 - **New shipped starter: `rig up factory-rsi`** — the single-rig recursive-self-improvement factory MVP. One rig, seven seats (`plan-planner`, `build-implementer`, `check-qa`, `review-reviewer`, `dogfood-tester`, `release-manager`, `orch-lead`), running the new `factory-rsi` workflow. A launch-tier product starter (a `product-team` sibling), workspace-agnostic — point `--cwd <repo>` at whatever the loop should improve.
 - **New builtin workflow: `factory-rsi`** — the inner loop `plan → implement → qa_check → review → release`, with `qa_check`/`review` `failed` → `implement` (bounded remediation), engine-routed — never an orchestrator relay. Dogfood is **decoupled** from this gated loop: the dogfood seat runs out-of-band against the **shipped** product and feeds its findings into the next plan (the RSI edge, ungated — no loop-stop in the MVP; the continuous out-of-band runtime mechanism is refined in a later release). The remediation loops are sanctioned only by the enforceable `loop_guards.max_hops`; a trip is an exception routed orchestrator-first (`exception_routing`), and `rig workflow resume` grants one more bounded window.
 - **Recorded-state cycles**: the next plan's input is the *recorded* dogfood findings (`evidence_ref` / the packet trail), never a seat's chat memory — the RSI feedback is durable recorded state.
-- **Publish stays a human act**: the release leg is two steps — `release_prep` (the release-manager PREPARES notes/docs/PR and records the evidence; un-gated, runs first) hands off to `release_signoff`, which holds the ship decision at a human gate (`gate.target: human@kernel`). Prepared artifacts exist before sign-off; no seat pushes, tags, publishes, or upgrades a host.
+- **Publish stays a human act**: the release leg is two steps — `release_prep` (the release-manager PREPARES notes/docs/PR and records the evidence; un-gated, runs first) hands off to `release_signoff`, which holds the ship decision at the configured human gate target. Prepared artifacts exist before sign-off; no seat pushes, tags, publishes, or upgrades a host.
 - **Rides the merged engine, no new machinery**: runs on the workflow engine + spec language + exception model as shipped, with the v0 hardcode seam (`target.rig: factory-rsi` + `preferred_targets` pin each role 1:1 to a seat) — no binding-layer dependency, no engine change. Runtime config: seats inherit their runtime's default model (no per-seat pin); plan/build/release/orch run on claude-code, and qa/review/dogfood run on codex for cross-runtime diversity against the builder.
 - **No migrations. No breaking changes.**
 
@@ -1003,7 +1355,7 @@ The v0.4.0 cascade-metadata hygiene findings (`missing_provenance` + `missing_ve
 
 ## [0.4.0] - 2026-06-20
 
-**Status**: wrap-gate CLEAR; lifecycle push / npm publish / tag held for founder-auth.
+**Status**: wrap-gate CLEAR; lifecycle push / npm publish / tag held for authorization from the project owner.
 
 ### Summary For Installing Agents
 
@@ -1050,7 +1402,7 @@ Five read-commands flip from firehose-by-default to compact-by-default — close
 ### Known Limitations / Carry-Forward
 
 - **Plugin-lineage drift in `openrig-core`** — the openrig-core plugin skill lineage is divergent/stale; full re-sync is OPR.0.4.1.4 (rides 0.4.1). Boot-path layers (canonical + hub cwd) verified current in wrap-gate AC-3 sweep. `rig skill audit` (slice 10) is the runtime mechanism for future drift detection.
-- All earlier "PUSHED to 0.4.1" carry-forwards from the original wrap-gate were RESTORED to 0.4.0 during the wrap: slice 34 (`rig ps` current-rig default + `-A`/`--all-rigs` + `resumeTokenPresent`) landed — see Token-Efficient Defaults; slice 35 (`rig scope` stage/verified/reconcile) landed — see New Top-Level CLI Verbs. Real-terminal-related slices 38 + 39 also shipped via founder live-dogfood forward-fix authorization 2026-06-21. Nothing of substance carries forward to 0.4.1 from the original wrap-gate set.
+- All earlier "PUSHED to 0.4.1" carry-forwards from the original wrap-gate were RESTORED to 0.4.0 during the wrap: slice 34 (`rig ps` current-rig default + `-A`/`--all-rigs` + `resumeTokenPresent`) landed — see Token-Efficient Defaults; slice 35 (`rig scope` stage/verified/reconcile) landed — see New Top-Level CLI Verbs. Real-terminal-related slices 38 + 39 also shipped via the project owner's live-dogfood forward-fix authorization on 2026-06-21. Nothing of substance carries forward to 0.4.1 from the original wrap-gate set.
 
 ### What To STOP Using
 
@@ -1065,10 +1417,10 @@ Five read-commands flip from firehose-by-default to compact-by-default — close
 
 - Wrap worktree clean on `8d55ea60`.
 - CLI surfaces source-verified against the command modules at the release SHA.
-- CLI→skill cascade sweep: canonical `openrig-work/skills/openrig-user/SKILL.md` → product mirror at `packages/daemon/specs/agents/shared/skills/core/openrig-user/SKILL.md` → hub cwd `.claude/skills/openrig-user/SKILL.md` + `.agents/skills/openrig-user/SKILL.md` — all byte-identical (md5 `e2aa9176`).
+- The historical CLI→skill cascade sweep reported the internal canonical skill source → product mirror at `packages/daemon/specs/agents/shared/skills/core/openrig-user/SKILL.md` → hub cwd `.claude/skills/openrig-user/SKILL.md` + `.agents/skills/openrig-user/SKILL.md` as byte-identical (reported md5 `e2aa9176`). This records the historical report, not a fresh mirror check.
 - cli-reference.md updated for 6 changed commands + new `rig skill` section; `last-verified-against-source` bumped to `8d55ea60`.
 - Stale-pattern grep (`dumps everything` / `--notify required` / `rig down 404`) returned 0 hits across active SKILL.md locations.
-- AC-6 self-check evidence: `substrate/shared-docs/openrig-work/missions/release-0.4.0/slices/36-release-durability-close/AC-6-wrap-gate-self-check-evidence.md`.
+- The historical AC-6 self-check evidence was internal and is not a public reproducible receipt.
 
 ---
 

CODE_OF_CONDUCT.md

@@ -0,0 +1,75 @@
+# Code of Conduct
+
+## Our pledge
+
+We as members, contributors, and maintainers pledge to make participation in OpenRig a
+harassment-free experience for everyone, regardless of age, body size, visible or invisible
+disability, ethnicity, sex characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive,
+and healthy community.
+
+## Our standards
+
+Examples of behaviour that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes, and learning from
+  the experience
+- Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behaviour:
+
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address, without their
+  explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement responsibilities
+
+Project maintainers are responsible for clarifying and enforcing our standards of acceptable
+behaviour and will take appropriate and fair corrective action in response to any behaviour that
+they deem inappropriate, threatening, offensive, or harmful. Maintainers have the right and
+responsibility to remove, edit, or reject comments, commits, code, issues, and other contributions
+that are not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all project spaces (the repository, Discussions, issues and
+pull requests) and when an individual is officially representing the project in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behaviour may be reported to the
+maintainers at **[email protected]**. All complaints will be reviewed and investigated
+promptly and fairly.
+All maintainers are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement guidelines
+
+Maintainers will follow these community impact guidelines in determining the consequences for any
+action they deem in violation of this Code of Conduct:
+
+1. **Correction.** A private, written warning, with clarity around the nature of the violation and
+   an explanation of why the behaviour was inappropriate. A public apology may be requested.
+2. **Warning.** A warning with consequences for continued behaviour, including no interaction with
+   the people involved for a specified period.
+3. **Temporary ban.** A temporary ban from any sort of interaction or public communication with
+   the community for a specified period.
+4. **Permanent ban.** A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org),
+version 2.1 by Coraline Ada Ehmke, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html and licensed under
+[Creative Commons Attribution 4.0 International](https://creativecommons.org/licenses/by/4.0/).
+This adaptation names OpenRig and its maintainers and summarizes the enforcement guidelines. Community impact guidelines
+were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).

CONTRIBUTING.md

@@ -0,0 +1,110 @@
+# Contributing to OpenRig
+
+Thanks for being here. OpenRig is built in the open and by the thing it is: a rig of coding
+agents and a small group of people. External pull requests and issues have started arriving
+faster than we planned for, which is the best problem to have. This page says how to get a
+change in with the least friction on both sides.
+
+## Before you start
+
+- **Bugs:** open an issue with the bug template. Include your OpenRig version (`rig --version`),
+  OS, Node version, which harnesses are involved (or none), and the relevant command and output.
+  Reports are public: remove credentials, private prompts, personal details and private paths
+  before posting. Share a small reproduction rather than a full transcript or instance dump.
+- **Features and behaviour changes:** open an issue or a Discussion in *Ideas* first. A short
+  "what I am trying to do and what stops me" saves both of us a rewrite. Small, obvious fixes do
+  not need an issue.
+- **Questions:** use [Discussions › Q&A](https://github.com/mvschwarz/openrig/discussions/categories/q-a),
+  not an issue.
+
+## Before a security or integration PR
+
+OpenRig connects your coding agents to each other: shared context, messaging, coordination and long-running seats.
+It's designed for your own machine or a trusted private network, for you and people you trust, not for the open
+internet. It doesn't try to act for you in the outside world; your agents already have tools for that.
+
+**Security-related PRs.** If you've found something exploitable, report it privately first (see
+[SECURITY.md](SECURITY.md)) rather than in a public PR. For hardening changes, tell us in the PR description:
+
+- the scenario: how this goes wrong for someone using OpenRig as it's designed to be used, and the evidence you have
+- who or what causes it, and how they reach the install
+- what the change costs everyone else: a refusal, an extra step, a new setting
+
+We look at the finding and the fix separately. We may agree with a finding and fix it differently, or decide the fix
+costs more than it protects. If the answers are missing we'll ask once, and close the PR with thanks if they don't
+come.
+
+**Integrations with other tools or projects.** Open an issue or an Ideas Discussion and wait for a maintainer's yes on
+scope before you build it; an issue on its own isn't a yes. Often the best home for an integration is your own
+repository, and we're happy to link to it.
+
+## Setting up
+
+Node `^22 || ^24` and a working `tmux` are required. Then:
+
+```bash
+git clone https://github.com/mvschwarz/openrig.git
+cd openrig
+npm install
+npm run build          # all workspaces
+npm test               # repo checks + daemon, cli, tui test suites
+npm run lint           # typecheck every package
+```
+
+`npm test` builds the daemon and runs repository checks before the package suites. Read the
+specific failure: `npm run mirror-skills` updates skill mirrors, and
+`npm run generate-context-packs` updates generated packs. Use them when their source changed and
+review the generated diff; neither command fixes every documentation failure. The UI unit-test
+suite is advisory and separate: `npm run test:ui`.
+
+For hands-on development, read the [check requirements](docs/reference/developing.md),
+[worktree setup](docs/reference/worktree-builds.md), and
+[machine changes](README.md#what-openrig-changes-on-your-machine). Use an isolated environment
+for changes that start daemons or agents; `OPENRIG_HOME` alone does not isolate provider settings.
+Permission configuration is an [explicit choice](docs/reference/getting-started.md#have-your-agent-configure-permissions).
+A checked-out tree is not the installed daemon; restarting an installed daemon does not adopt
+your working copy.
+
+## Making the change
+
+- One concern per pull request. Keep unrelated refactors separate; explain any refactor needed
+  for the fix.
+- Keep the diff small enough to review in one sitting. If it is not, say why in the description.
+- Add or update a test where the change is testable. Use focused deterministic tests where
+  possible. For terminal or provider behaviour, state what was exercised with the actual runtime
+  and what was simulated; a stub alone does not prove the native interaction works.
+- Do not edit `CHANGELOG.md`. Maintainers write release notes at the tag.
+- Do not bump versions.
+- Match the surrounding style. `npm run lint` typechecks; it does not format code.
+- Write commit messages in the form the log already uses: `fix(cli): …`, `feat(daemon): …`,
+  `docs(reference): …`, `harness: …`.
+
+## The pull request
+
+Fill in the template. The three things a reviewer needs are: what a user gets, how you verified
+it, and anything you were unsure about. State the revision and relevant local changes you tested,
+what you actually ran, and any checks you could not run. Redact private information from evidence.
+
+Contributions follow the repository's [Apache-2.0 license](LICENSE). Preserve attribution and any
+applicable license notices when adapting third-party material.
+
+## What to expect from us
+
+- We aim to acknowledge issues and pull requests within **one day**. An acknowledgement is not
+  a completed review or a merge decision.
+- Our target for a first substantive review decision on an external PR is **seven days**. If it
+  takes longer, we explain what is pending on the PR. This is a target, not a guaranteed deadline.
+- Labels you will see: `needs-repro` (we could not reproduce it yet; waiting on versions or steps),
+  `fixed-on-main` (merged, not yet on npm), `good first issue`, `help wanted`, `discussion`
+  (direction question; continues in Discussions).
+
+Reviews here are done by people and by the project's own agents. An agent may ask the first
+clarifying question or run the reproduction; a maintainer makes the merge decision.
+
+## Where things live
+
+- Repository reference: `docs/reference/`; user documentation: [openrig.dev/docs](https://openrig.dev/docs).
+- Skills: `packages/daemon/specs/agents/shared/skills/` and plugin skills under
+  `packages/daemon/assets/plugins/`; static context-pack sources: `packages/daemon/context-packs-src/`.
+  Generated packs live in `packages/daemon/context-packs/` and are not hand-edited or committed.
+- Releases: [GitHub Releases](https://github.com/mvschwarz/openrig/releases) and npm `@openrig/cli`.

README.md

@@ -1,45 +1,294 @@
 # OpenRig
 
+[![npm version](https://img.shields.io/npm/v/@openrig/cli)](https://www.npmjs.com/package/@openrig/cli) [![npm downloads](https://img.shields.io/npm/dw/@openrig/cli)](https://www.npmjs.com/package/@openrig/cli) [![License: Apache 2.0](https://img.shields.io/github/license/mvschwarz/openrig)](LICENSE) [![GitHub stars](https://img.shields.io/github/stars/mvschwarz/openrig?style=social)](https://github.com/mvschwarz/openrig/stargazers)
+
 A harness wraps a model. A rig wraps your harnesses. Define your agent team in YAML, boot it with one command. Claude Code and Codex in the same rig, managed as one system.
 
-OpenRig turns AI coding agents from a pile of terminal sessions into a persistent, organized team. A rig is the team that doesn't go away. If you've got tabs full of agents you're afraid to close, this is the layer you're missing: it's open source, it's local, and you're four commands away.
+OpenRig turns AI coding agents from a pile of terminal sessions into a persistent, organized team. Talk to a lead agent about the outcome you want; it can coordinate specialists across teams and bring you results and decisions that need your attention. Start with a repository and one useful change, then keep the team's work and context at the same addresses.
 
-The OpenRig UI is experimental and in maintenance mode. It is not under active development; support is best-effort. The CLI is the primary supported interface. Contributions welcome.
+**Guide:** [Getting started](docs/reference/getting-started.md) · **Stuck?** [Help](docs/reference/help.md) · **Questions:** [Q&A](https://github.com/mvschwarz/openrig/discussions/92) · **Updates and demos:** [@_feralmachine on X](https://x.com/_feralmachine)
+
+## See it running
+
+![The OpenRig TUI: the build rig as a graph, then as a table of seats with runtime, model, context and state, then one seat in detail (real recording, 10 seconds)](assets/readme/openrig-agents-working.gif)
+
+**Start here:** [the guided first-use path](docs/reference/getting-started.md): install, launch a two-agent team in your repository, and get one reviewed change.
+
+Not setting this up today? Get the next walkthrough and occasional OpenRig updates → https://openrig.dev/follow
+
+## Install and first run
+
+Requires Node.js 22 or 24 and tmux, on macOS or Linux. On a Mac with Apple silicon, use Node.js 22 ([compatibility history](docs/releases/v0.5.15.md#known-compatibility-limitation)). Native Windows is not supported yet, and WSL2 has not been tested. Launching a rig writes provider hooks and workspace trust settings. Before running the commands below, read [what OpenRig changes on your machine](#what-openrig-changes-on-your-machine) and back up the relevant files.
 
 ```bash
 npm install -g @openrig/cli
-rig setup
-rig up product-team
-rig ui open
+rig setup --dry-run
 ```
 
-![OpenRig UI](https://openrig.dev/screenshots/remotion/hero-ui-workspace.png)
+To install with Bun instead, run `bun add -g @openrig/cli`. OpenRig still runs on Node.js, so install Node.js 22 as well. Bun may block this package's postinstall script, in which case the Node.js and SQLite check described under [what OpenRig changes on your machine](#what-openrig-changes-on-your-machine) does not run at install time.
 
-It runs locally: a daemon, a SQLite database, a CLI, and a dashboard. The agents are ordinary Claude Code and Codex sessions in tmux. `product-team` is the fuller starter, 7 seats, 4 Claude and 3 Codex, with an orchestration HA pair plus development and review pods.
+Choose the working account you already have: **Claude Code, Codex, or both**. Reuse an explicit choice; no second subscription is required. `rig setup --dry-run` previews the broader setup, but applying `rig setup` checks both harnesses and cmux. It is optional for the [selected-provider path](docs/reference/getting-started.md#choose-your-providers).
 
-Because 4 Claude seats run at once, single-plan users should expect provider throttling. For the light-footprint path, use `conveyor`, a 4-seat starter with 2 Claude and 2 Codex.
+Before launching, your agent asks once: **“Allow your agents to run OpenRig commands without repeated permission prompts?” Yes — recommended / No — keep prompts.** This covers every `rig` command, including starting/stopping agents and configuration, at personal project scope unless you explicitly choose user-wide sessions. It is not global YOLO or permission to invent work. On Yes, the agent [adds and verifies native rules](docs/reference/getting-started.md#have-your-agent-configure-permissions); No or no answer leaves settings unchanged. An existing explicit choice is reused. Say “Undo the OpenRig command allowances added by this setup” to remove only its additions.
+
+Check `tmux -V` and only your selected CLI/login: `claude --version` plus
+`claude auth status`, or `codex --version` plus `codex login status`. If needed,
+sign in once with `claude auth login` or `codex login`; do not install or log in
+to an unused provider.
+
+| Team | Starter | Models |
+| --- | --- | --- |
+| Two Codex agents | `first-project` | Both `gpt-6-astra` (unchanged) |
+| Two Claude agents | `first-project-claude` | Configured native Claude default |
+| Claude owner + Codex checker | `first-project-mixed` | Claude default + `gpt-6-astra` |
+
+All three use the same owner/checker roles and task. Show the selected runtime,
+configured model and command before launch; confirm the account supports the
+model instead of silently falling back. The kernel starts automatically and
+selects from available authenticated providers independently of these two project
+agents. A missing unused provider is not a setup requirement.
 
 ```bash
-# Preview the smaller starter
-rig specs preview conveyor
+cd /path/to/your/repository
+starter=first-project  # or first-project-claude or first-project-mixed
+rig specs preview "$starter" --kind rig
+rig up "$starter" --cwd . --plan
+rig up "$starter" --cwd .
+rig tui --shared
+```
 
-# Boot the light-footprint path
+The kernel provides separate operational support and the shared dashboard. To detach without stopping the dashboard, press Ctrl-b then d; `rig tui --shared` returns to that view. Plain `rig tui` opens an independent view. Closing a viewing terminal does not mean you should relaunch the team.
+
+Check project-seat readiness with `rig ps --nodes --rig "$starter"` and resolve any authentication, trust or permission prompt before assigning work. Then give the owner one bounded outcome from your repository:
+
+```bash
+rig send "dev-owner@$starter" 'Implement <one useful change>. Track the task in the queue and return its ID. Keep it local, verify the behavior, ask dev-check in this rig to check the exact candidate, and record the result and how I can try it.'
+rig queue list --destination "dev-owner@$starter" --limit 1000
+```
+
+Sending a message does not itself create a queue item; the owner records the task. Read the final artifact and the review of its exact candidate, then return to the same owner for the next change. [The guided first-use path](docs/reference/getting-started.md) covers readiness, a useful task, a reviewed result, Herdr/cmux terminals and recovery.
+
+Not setting this up today? Get the next walkthrough and occasional OpenRig updates → https://openrig.dev/follow
+
+## Community
+
+- **Questions:** [Discussions › Q&A](https://github.com/mvschwarz/openrig/discussions/categories/q-a)
+- **Bugs and feature requests:** [open an issue](https://github.com/mvschwarz/openrig/issues/new/choose)
+- **Contributing:** [CONTRIBUTING.md](CONTRIBUTING.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Security policy](SECURITY.md) · [Getting help](.github/SUPPORT.md)
+- **Videos:** [youtube.com/@openrig](https://www.youtube.com/@openrig)
+- **Releases:** [GitHub Releases](https://github.com/mvschwarz/openrig/releases) and npm `@openrig/cli`
+
+We aim to acknowledge issues and pull requests within one day; see [CONTRIBUTING.md](CONTRIBUTING.md#what-to-expect-from-us) for review targets.
+
+## What OpenRig changes on your machine
+
+OpenRig writes instance state, provider integration and workspace files as part
+of setup and operation. These include **trust settings and executable hooks**.
+The summary below follows this source revision; check `rig --version` when
+using a published package, since repository guidance can be ahead of npm.
+
+| When | What changes and why |
+| --- | --- |
+| **npm installation** | Installs the CLI, bundled components and dependencies under your npm prefix (with Bun, under Bun's global directory). OpenRig's postinstall checks the Node.js version and that the SQLite module loads; Bun may block this script. It does not run daemon or provider setup. |
+| **`rig setup`** | Attempts missing tools and writes an OpenRig block in `~/.tmux.conf` for mouse support and scrollback. On macOS it can install cmux and enable its automation socket control in `~/.config/cmux/settings.json`. `--full` adds workstation tools. `--dry-run` shows setup's plan without applying it. |
+| **Daemon startup** | Creates/updates instance state under `OPENRIG_HOME` (normally `~/.openrig`), including its database and managed plugin resources. Seeds the `openrig-skills` discovery skill in `~/.claude/skills` and `~/.agents/skills`, subject to existing version ownership. With `runtime.codex.hooks_enabled` enabled (the default), writes Codex hook configuration and trust records as described below—even before a rig launches. |
+| **Rig/seat launch and attachment** | Creates tmux sessions, supplies seat identity and daemon connection environment, and projects selected guidance, skills, plugins and runtime resources into the workspace. Managed startup pre-trusts the workspace. Claude context collection can also be provisioned for attached sessions and refreshed during monitoring. |
+| **Explicit permission configuration** | The built-in bootstrap does **not** add `rig` command allow rules. Agent-guided setup recommends Yes and requires your actual answer before the agent [adds rules at your chosen scope](docs/reference/getting-started.md#have-your-agent-configure-permissions). No/no answer preserves settings; existing choices and stricter rules remain relevant. Broader access is separate. |
+
+The provider files are separate from instance state. Here `~` means the daemon
+user's home; changing `OPENRIG_HOME` alone does not isolate provider configuration.
+
+- **Claude Code:** managed startup writes workspace trust and onboarding completion
+  to `~/.claude.json`. In the workspace, `.claude/settings.local.json` receives
+  the context collector's `statusLine` command and selected activity hooks;
+  helper scripts live under `.openrig/`. Selected settings/MCP resources can also
+  change that settings file and `.mcp.json`. The shared settings resource sets
+  `permissions.defaultMode` to `acceptEdits` and enables Exa/Context7 MCP entries;
+  selected MCP resources configure those external services. Built-in bootstrap
+  no longer writes a command allowlist to `~/.claude/settings.json` or removes
+  older allowances. The trust writer uses the daemon home, so a custom
+  `CLAUDE_CONFIG_DIR` is not a general relocation of these writes.
+- **Codex:** writes the daemon's `CODEX_HOME/config.toml` (normally
+  `~/.codex/config.toml`). Startup enables hooks, adds the OpenRig activity relay
+  commands and pre-writes trust hashes for those commands. Seat startup adds
+  `trust_level = "trusted"` for the workspace; selected config resources can
+  add MCP settings. Recognized update notices can be skipped during launch,
+  recording the skipped version in Codex's cache; this is not an update install.
+
+Activity relays send event type/subtype, seat/runtime identity, timestamps and
+native session identity to the configured OpenRig daemon's `/api/activity/hooks`
+endpoint, using its activity token. That payload excludes prompt text and tool
+arguments. Claude's collector writes context/token usage, session/transcript-path
+metadata and available rate-limit data to the instance's `state/context-usage`
+and `state/provider-usage`. Provider and selected MCP connections have their own
+data flows. Daemon plugin initialization also checks the OpenRig plugin release
+endpoint on GitHub.
+
+Managed launches supply `HOME`, `CODEX_HOME` and `OPENRIG_*` identity/connection
+variables. Claude uses `--permission-mode acceptEdits` and defaults to the classic
+renderer for terminal scrollback. Codex uses `-s workspace-write` unless a named
+profile governs its sandbox; the default does not force an approval-policy flag.
+Fresh Codex launches also add writable access to the workspace's `.git` and the
+pod's shared queue-state directory with `--add-dir`; the shared root comes from
+`OPENRIG_SHARED_DOCS_ROOT` or `~/.openrig/shared-docs`.
+YOLO is **off by default**. An explicitly selected full-bypass policy selects
+Claude's `--dangerously-skip-permissions` or Codex's
+`-s danger-full-access -a never`. The legacy environment-only `OPENRIG_YOLO=1`
+path still selects only Codex's sandbox; a resolved policy overrides that
+environment setting.
+
+Permission mode controls native execution permissions; work posture is separate
+project guidance. Use `rig policy permissions list|show|current|apply` for rig
+policy configuration (the four `rig policy` aliases remain compatible). Use
+`rig seat set-permissions <seat> --mode <mode> --reason <text>` for an audited
+future-launch choice: `floor`, `full_bypass`, or `inherit` to clear the seat
+override. Additional Claude modes such as `auto` require support from the exact
+managed Claude executable at the seat's working directory; selection and launch
+each check it. Unsupported or changed contexts refuse without a fallback.
+This does not relaunch the seat
+or change its current native process, history, rules or hooks. `rig seat status`
+separates the desired selection from the last launch arguments; neither proves
+native enforcement. See the [permission guide](docs/reference/getting-started.md#per-seat-permission-mode).
+
+Managed hook blocks target OpenRig's entries and retain unrelated hooks, but
+trust entries, selected resource keys and Claude's existing status-line command
+can be replaced. Some writers recover unreadable settings as empty objects;
+this is not a complete preservation or rollback guarantee. Back up relevant
+files before first use. Daemon/bootstrap writes are automatic and do not each
+have an interactive preview; `rig setup --dry-run` does not preview every later
+startup effect.
+
+## What It Does
+
+OpenRig is a multi-agent harness — it manages the system that coding agents form when you run them together. Not the agents themselves, but the team they create: which sessions are running, how they relate, how to recover after a reboot, and how to stop it from becoming terminal sprawl.
+
+- **Define** topologies in YAML (RigSpec) with pods, edges, and continuity policies
+- **Boot** everything with `rig up` — tmux sessions, harnesses, startup files, readiness checks
+- **See** rigs, pods, and seats in the TUI topology table and graph; inspect projects, specs, feeds, and instance health
+- **Discover** existing Claude Code and Codex sessions in tmux and adopt them into a managed rig
+- **Snapshot** the topology with `rig down --snapshot`, restore by name with `rig up <name>`
+- **Communicate** across agents with `rig send`, `rig broadcast`, and `rig chatroom`
+- **Protect** a seat where you type by hand: `rig seat set-typing-guard <seat> --enabled true --reason <text>` holds automatic messages and wakes instead of typing them into that seat (off by default; see `rig seat set-typing-guard --help`)
+- **Connect** Slack through an app you create in your own workspace; the experimental `rig slack manifest` prints that app's manifest ([setup guide](docs/reference/slack-app-setup.md))
+- **Evolve** running topologies with `rig grow`, `rig shrink`, `rig launch`, `rig remove`
+
+Every agent runs in a tmux session you can attach to, inspect, and work with directly.
+
+## Starter Rigs
+
+Use `first-project`, `first-project-claude`, or `first-project-mixed` for the
+same focused first-use path on your selected providers. `product-team` is an optional
+larger product-development example:
+
+```bash
+rig specs preview product-team --kind rig
+rig up product-team
+```
+
+Use it when you want a larger product squad: two orchestrators, implementation, QA, design, and two independent reviewers.
+
+For a smaller starter, use `conveyor`:
+
+```bash
+rig specs preview conveyor --kind rig
 rig up conveyor
 ```
 
-## First Run
+`conveyor` is a four-seat starter mixing Claude Code and Codex. It shows a handoff path through intake, planning, build, and review; `first-project` remains the smaller two-seat starting point.
 
-After `product-team` boots, `rig ps` shows the fleet map and `rig ps --nodes --rig product-team` shows the running pods and seats. When you're ready to shut the team down and bring it back, use the same rig name:
+Also ships: `implementation-pair`, `adversarial-review`, `research-team`, and `secrets-manager` (HashiCorp Vault managed by a specialist agent).
+
+Browse the library:
 
 ```bash
-rig ps
-rig down product-team
-rig up product-team
+rig specs ls
 ```
 
-`rig ps` is a fleet glance. `rig down product-team` snapshots the team and stops it. `rig up product-team` brings it back by name from that snapshot.
+## How It Works
 
-## Upgrading an existing instance to 0.5.9
+OpenRig is a local daemon + CLI + terminal UI + MCP server, built on tmux. The older React web UI remains in maintenance mode with best-effort support.
+
+```
+CLI / TUI / MCP
+      |
+Hono HTTP daemon
+      |
+  Domain services
+      |
+  SQLite + tmux + runtime adapters
+```
+
+- **CLI**: Commands for both humans and agents to launch teams, inspect state, send messages, track owned work, and manage context.
+- **TUI**: Topology explorer, table and graph views, seat details, Specs, Projects, Terminals, Feed, and System. Navigate with the keyboard, mouse, or command bar.
+- **MCP**: Tools so agents can manage their own topology (`rig_up`, `rig_ps`, `rig_send`, `rig_chatroom_send`, etc.)
+- **Runtimes**: Native Claude Code and Codex sessions, terminal nodes, and a Pi adapter using an RPC runner inside a terminal pane.
+
+## Terminal UI and Workspaces
+
+The TUI shows the team's coordination state; herdr and cmux show the actual agent terminals alongside it. Use `rig tui commands` to list the TUI's command-bar navigation, or [try the interactive TUI tour](https://openrig.dev/tour/workspace).
+
+![OpenRig TUI topology graph showing seven agent seats grouped into product, development, and QA pods](assets/ui/screenshots/tui-topology.png)
+
+*Captured from the interactive TUI demo using fictional project data.*
+
+With herdr installed and connected, open the starter's terminals together:
+
+```bash
+rig terminal open first-project --provider herdr
+```
+
+For cmux, use `--provider cmux`. In the TUI, a rig's detail view has a `term ▸ rig <name>` link that opens every running seat of that rig in the default terminal provider; with herdr that is up to 16 seats per tab, in a workspace named after the rig. The underlying sessions remain accessible through tmux. See the [terminal workspace guide](docs/reference/getting-started.md#share-the-dashboard-and-return-to-it) for setup and returning to an existing view.
+
+## Key Concepts
+
+- **RigSpec**: Declarative multi-agent harness definition in YAML. Pods, members, edges, continuity policies, culture file.
+- **AgentSpec**: Reusable agent blueprint with skills, guidance, hooks, profiles, and startup contracts.
+- **Seat**: A stable role and address in a rig, such as `dev-owner@first-project`. The conversation occupying it can change while its identity and authored context remain.
+- **Pod**: A group of related seats with shared guidance and context. Each agent still has its own context window.
+- **Discovery**: `rig discover` fingerprints existing tmux sessions. `rig adopt` brings them under management.
+- **Snapshot/Restore**: `rig down --snapshot` captures full state. `rig up <name>` restores from latest snapshot. Restore reports per-node outcomes (resumed, fresh, or failed).
+- **RigBundle**: Portable archive with vendored AgentSpecs and SHA-256 integrity. Share topologies across machines.
+- **Culture**: CULTURE.md sets coordination norms for the group. Research rigs get exploratory culture. Implementation rigs get conservative, trust-but-verify culture.
+
+## Agent-Managed Software
+
+A rig can package actual software alongside the agents that manage it. The shipped example is `secrets-manager`: a HashiCorp Vault instance operated by a specialist agent.
+
+```bash
+rig up secrets-manager
+rig env status secrets-manager
+rig send vault-specialist@secrets-manager "Check Vault health and report status." --verify
+```
+
+Requires Docker for service-backed rigs.
+
+## Upgrading an existing instance
+
+For an existing installation, follow the [upgrade procedure](skills/_canonical/core/openrig-upgrade/SKILL.md) and the [0.5.14 release notes](docs/releases/v0.5.14.md). Preserve live seats during the upgrade; `rig down` is not an upgrade step. Upgrading to 0.6.0 also requires Node.js 22 or 24: see [Moving off Node 20](#moving-off-node-20) and the [0.6.0 release notes](docs/releases/v0.6.0.md).
+
+### Moving off Node 20
+
+OpenRig 0.6.0 supports Node.js 22 and 24 only. Its SQLite binding
+(better-sqlite3 13) requires Node 22 or newer. Node 20 is no longer supported;
+the install check refuses it with an explanation.
+
+If you run OpenRig on Node 20, switch Node first, then reinstall the CLI under
+the new Node (a version manager keeps a separate global package set for each
+Node):
+
+```bash
+nvm install 22          # or 24; fnm or your package manager work the same way
+npm install -g @openrig/cli
+rig --version
+```
+
+Your existing OpenRig data stays where it is. The daemon reopens the same
+database under the new binding and applies any pending migrations in place.
+Restart the daemon under the new Node by following the upgrade procedure above.
+
+### Crossing the 0.5.9 layout boundary
+
+The migration below still applies when upgrading from a pre-0.5.9 instance.
 
 0.5.9 makes `$OPENRIG_HOME/context` the addressable context library, writes
 Claude telemetry to `state/context-usage` (and provider telemetry to
@@ -80,96 +329,16 @@ The helper never removes the legacy telemetry or library. Retirement follows
 separate stable runtime, writer, reader, and recovery proof. Daemon, database,
 seat, plugin, and release lifecycle actions remain agent-owned.
 
-## What It Does
-
-OpenRig is a multi-agent harness — it manages the system that coding agents form when you run them together. Not the agents themselves, but the team they create: which sessions are running, how they relate, how to recover after a reboot, and how to stop it from becoming terminal sprawl.
-
-- **Define** topologies in YAML (RigSpec) with pods, edges, and continuity policies
-- **Boot** everything with `rig up` — tmux sessions, harnesses, startup files, readiness checks
-- **See** the topology in a live graph with explorer, node detail, and system log
-- **Discover** existing Claude Code and Codex sessions in tmux and adopt them into a managed rig
-- **Snapshot** the full topology on `rig down`, restore by name with `rig up <name>`
-- **Communicate** across agents with `rig send`, `rig broadcast`, and `rig chatroom`
-- **Evolve** running topologies with `rig expand`, `rig shrink`, `rig launch`, `rig remove`
-
-Every agent runs in a tmux session you can attach to, inspect, and work with directly.
-
-## Starter Rigs
-
-OpenRig's hero starter is `product-team`, the fuller product-development rig:
-
-```bash
-rig specs preview product-team
-rig up product-team
-```
-
-Use it when you want the week-one experience OpenRig is built around: an orchestrator HA pair, development work, review work, and enough moving pieces for the coordination layer to matter.
-
-For a smaller starter, use `conveyor`:
-
-```bash
-rig specs preview conveyor
-rig up conveyor
-```
-
-`conveyor` is the smallest shippable software factory, one command. It keeps the footprint lower for single-plan users while still showing a real handoff path through intake, planning, build, and review.
-
-Also ships: `implementation-pair`, `adversarial-review`, `research-team`, and `secrets-manager` (HashiCorp Vault managed by a specialist agent).
-
-Browse the library:
-
-```bash
-rig specs ls
-```
-
-## How It Works
-
-OpenRig is a local daemon + CLI + MCP server + React UI, built on tmux.
-
-```
-CLI / UI / MCP
-      |
-Hono HTTP daemon
-      |
-  Domain services
-      |
-  SQLite + tmux + runtime adapters
-```
-
-- **CLI**: 40+ commands designed for both humans and agents. Every mutating command ends with what happened, current state, and next action.
-- **UI**: Explorer sidebar, topology graph with pod grouping, node detail panel, system log, chatroom.
-- **MCP**: 17 tools so agents can manage their own topology (`rig_up`, `rig_ps`, `rig_send`, `rig_chatroom_send`, etc.)
-- **Runtimes**: Claude Code, Codex, and terminal nodes. Adapters for Pi and OpenCode in development.
-
-## Key Concepts
-
-- **RigSpec**: Declarative multi-agent harness definition in YAML. Pods, members, edges, continuity policies, culture file.
-- **AgentSpec**: Reusable agent blueprint with skills, guidance, hooks, profiles, and startup contracts.
-- **Pod**: Bounded context group. Agents in a pod share memory and can maintain each other's context.
-- **Discovery**: `rig discover` fingerprints existing tmux sessions. `rig adopt` brings them under management.
-- **Snapshot/Restore**: `rig down --snapshot` captures full state. `rig up <name>` restores from latest snapshot. Restore reports per-node outcomes (resumed, fresh, or failed).
-- **RigBundle**: Portable archive with vendored AgentSpecs and SHA-256 integrity. Share topologies across machines.
-- **Culture**: CULTURE.md sets coordination norms for the group. Research rigs get exploratory culture. Implementation rigs get conservative, trust-but-verify culture.
-
-## Agent-Managed Software
-
-A rig can package actual software alongside the agents that manage it. The shipped example is `secrets-manager`: a HashiCorp Vault instance operated by a specialist agent.
-
-```bash
-rig up secrets-manager
-rig env status secrets-manager
-rig send vault-specialist@secrets-manager "Check Vault health and report status." --verify
-```
-
-Requires Docker for service-backed rigs.
-
 ## Requirements
 
-- Node.js 20, 22, or 24 (even-numbered LTS releases; odd releases like 25 lack native addon prebuilds)
+- Node.js 22 or 24 (the supported versions in this release). Node 20 is no
+  longer supported. Node 26 and other versions are untested. On a Mac with Apple
+  silicon, use Node.js 22: see the [compatibility history](docs/releases/v0.5.15.md#known-compatibility-limitation).
 - tmux
+- macOS or Linux. Native Windows is not supported yet, and WSL2 has not been tested
 
 Optional:
-- cmux for `Open CMUX` node surface controls
+- herdr or cmux for terminal workspaces showing the agents together
 - Docker for service-backed rigs and managed apps
 
 ## Setup and Troubleshooting
@@ -180,30 +349,31 @@ Optional:
 
 Both commands support `--json` for agent-driven workflows.
 
-Managed runtime boot (during `rig up`) may modify runtime config for core bootstrap and spec-selected runtime resources. `rig setup` discloses these paths so agents know what may be changed:
-- global Claude: `~/.claude/settings.json` for minimal OpenRig command allowlisting
-- global Claude state: `~/.claude.json` for managed workspace trust and onboarding completion
-- project Claude: `.claude/settings.local.json` for context collector/activity hooks and selected `claude_settings_fragment` resources
-- project Claude MCP: `.mcp.json` for selected `claude_mcp_fragment` resources
-- global Codex: `~/.codex/config.toml` for workspace trust and selected `codex_config_fragment` resources
+Before setup or managed launch, review [what OpenRig changes on your machine](#what-openrig-changes-on-your-machine), including provider trust, hooks and selected runtime resources.
 
 Already-running adopted sessions may need restart before they pick up newly written runtime config.
 
-**For agents:** Ask the user whether they want core setup (`rig setup`) or the fuller workstation path (`rig setup --full`) before choosing the invocation. Inspect the result with `--json` and use `rig doctor` to finish any remaining machine-specific issues.
+**For agents:** First ask which available provider(s) the user wants, reusing an explicit choice. Recommend the working account they already have and follow the selected-provider guide above. Offer core setup (`rig setup`) or the fuller workstation path (`rig setup --full`) only when they want those additional tools. Inspect the result with `--json` and use `rig doctor` to finish any remaining machine-specific issues. When OpenRig itself misbehaves, read [docs/reference/help.md](docs/reference/help.md) (installed agents can run `rig context get help`; the same text is at [openrig.dev/help/agents](https://www.openrig.dev/help/agents)): it covers the next step, known problems, and how to reach the team if you're still stuck.
 
 ## Comparison with Claude Managed Agents
 
-Anthropic shipped Claude Managed Agents — a cloud-hosted, Claude-only runtime at $0.08/session-hour. OpenRig is the local side: open source, cross-harness, runs on your machine, costs nothing.
+OpenRig is open source and self-hosted, with Claude Code and Codex in the same team. You operate it on your own infrastructure; the selected providers' model usage costs still apply.
 
 [Full comparison](https://openrig.dev/compare/claude-managed-agents)
 
 ## Links
 
 - **Website**: [openrig.dev](https://openrig.dev)
-- **Blog**: [Why I Built OpenRig](https://esoteric.run/blog/why-i-built-openrig)
-- **Docs**: [openrig.dev/docs](https://openrig.dev/docs)
+- **Docs**: [openrig.dev/docs](https://openrig.dev/docs) ([documentation index for agents](https://openrig.dev/llms.txt))
+- **Blog**: [openrig.dev/blog](https://openrig.dev/blog) · [Why I Built OpenRig](https://esoteric.run/blog/why-i-built-openrig)
 - **Open Specification**: [openrig.dev/specs](https://openrig.dev/specs)
-- **Twitter**: [@_feralmachine](https://twitter.com/_feralmachine)
+- **Videos**: [youtube.com/@openrig](https://www.youtube.com/@openrig)
+- **X**: [@_feralmachine](https://twitter.com/_feralmachine)
+- **Follow the project**: [openrig.dev/follow](https://openrig.dev/follow)
+
+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=mvschwarz/openrig&type=Date)](https://star-history.com/#mvschwarz/openrig&Date)
 
 ## License
 

SECURITY.md

@@ -0,0 +1,51 @@
+# Security policy
+
+## Supported versions
+
+Only the latest published version on npm (`@openrig/cli`) is supported. Fixes are developed on
+`main` and released after verification; a merged fix is not necessarily in the published package.
+Include the affected version even when reporting a problem in an older installation.
+
+## What OpenRig touches
+
+OpenRig runs a local daemon, drives coding agents in tmux sessions on your machine, and writes
+configuration for those harnesses (for example under `~/.claude` and `~/.codex`). The README
+section [What OpenRig changes on your machine](README.md#what-openrig-changes-on-your-machine)
+describes these effects and the trust/permission choices. Unexpected access, disclosure or
+permission changes are useful reports; include what you expected and what you observed.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a vulnerability.
+
+Open the repository's [Security page](https://github.com/mvschwarz/openrig/security). If
+**Report a vulnerability** is available, use it to send a private report to the maintainers.
+The reporter and authorized advisory collaborators can also see that report; it is not public.
+Availability depends on the repository setting, not on this file being present.
+
+If that option is unavailable, ask in [Discussions Q&A](https://github.com/mvschwarz/openrig/discussions/categories/q-a)
+for a private security contact. Post only the request for a channel: do not include the
+vulnerability details, reproduction, logs, credentials or affected private systems in public.
+Wait for the private channel before sharing the report.
+
+Include: the OpenRig version, the harnesses involved, the steps to reproduce, and what an attacker
+could do. A proof of concept is welcome; a working exploit against a third party's machine is not.
+
+## What to expect
+
+- We will acknowledge the report and coordinate assessment and next steps privately.
+- Assessment and fix timing depend on impact and reproduction; no fixed deadline is promised.
+- We will agree on disclosure and credit with you. You can ask to remain anonymous.
+
+## Scope notes
+
+- OpenRig is designed for your own machine or a trusted private network, for you and people you trust, not for the
+  open internet. We assess reports by their practical impact on a user in that setup. Exposing an install to the open
+  internet isn't a supported deployment. OpenRig's own gateway integrations with outside services, such as Slack, and
+  anything that lets an untrusted party reach the daemon or an agent are in scope.
+- OpenRig assumes the machine and the accounts it runs under are trusted by their owner. Reports
+  that require a hostile local user with the same account are still welcome but are unlikely to be
+  treated as high severity.
+- A harness carrying out an intentionally authorized operation is not by itself evidence of an
+  OpenRig vulnerability. Reports of OpenRig bypassing a chosen permission, changing trust
+  unexpectedly, or routing data or actions to the wrong destination are in scope.

context7.json

@@ -0,0 +1,30 @@
+{
+  "url": "https://context7.com/mvschwarz/openrig",
+  "public_key": "pk_HcRwWEoFBsmU1mo5VIvWw",
+  "projectTitle": "OpenRig",
+  "description": "OpenRig is an open-source multi-agent harness: define a team of Claude Code and Codex agents in YAML, boot it with the rig CLI, and coordinate the agents through tmux sessions, a durable queue and a local daemon.",
+  "folders": [],
+  "excludeFolders": [
+    "docs/releases",
+    "packages/daemon/specs",
+    "packages/daemon/test",
+    "packages/test-system",
+    "skills/_canonical/process",
+    "skills/_canonical/pm",
+    "spike",
+    "docker",
+    "**/node_modules",
+    "**/fixtures"
+  ],
+  "excludeFiles": [],
+  "rules": [
+    "Install with npm install -g @openrig/cli. OpenRig requires Node.js 22 or 24 and tmux; the first-project starter also requires an authenticated Codex CLI.",
+    "Preview before launching: rig specs preview <spec>, then rig up <spec> --cwd . --plan, then rig up <spec> --cwd .",
+    "Check seat readiness with rig ps --nodes --rig <rig>, not only daemon health from rig status.",
+    "Inside a rig, an agent runs rig whoami --json first and treats its output as its identity.",
+    "rig send <session> \"message\" types into a peer's terminal and presses Enter; rig capture <session> reads that peer's screen.",
+    "Work another agent must act on goes in the queue (rig queue create or rig queue handoff); a message informs but does not assign work.",
+    "Use rig start to bring rigs back after a reboot or daemon restart.",
+    "Run rig --help for the current command surface; the CLI is authoritative over older examples."
+  ]
+}

docker/testbed/Dockerfile.scenarios

@@ -0,0 +1,7 @@
+# Thin CI layer over the EXISTING installed-package testbed. No credentials,
+# host mounts, provider binaries or additional package installation.
+ARG TESTBED_IMAGE
+FROM ${TESTBED_IMAGE}
+COPY runner.mjs /opt/openrig-testbed/runner.mjs
+COPY scenarios/ /opt/openrig-testbed/scenarios/
+CMD ["node", "/opt/openrig-testbed/runner.mjs", "healthy"]

docker/testbed/base-image

@@ -1,14 +1,4 @@
-# openrig-testbed base image — the digest-pinned LTS-slim Linux (plan §1: "digest-pinned, not
-# tag-floating — byte-reproducible builds; the pin recorded in the image manifest").
-#
-# UNRESOLVED SLOT — resolve HOST-SIDE (locus ruling, the L0 build runbook). The VM seat has no
-# container runtime and cannot pull/inspect a real digest, so this is a host-resolved input:
-#
-#   docker pull debian:bookworm-slim
-#   docker inspect --format '{{index .RepoDigests 0}}' debian:bookworm-slim
-#
-# then replace this comment block with the single resulting reference, e.g.
-#   debian:bookworm-slim@sha256:<64-hex>
-#
-# Exactly one digest-pinned ref. Until resolved, the build verb REFUSES to build (no tag-floating
-# base) — readBaseImage() loud-fails on this comment-only slot.
+# Docker Hub library/debian bookworm-slim OCI index, resolved 2026-09-29.
+# Registry response bytes SHA256 verified against Docker-Content-Digest.
+# amd64 and arm64 are present; image execution is verified in CI, not by this pin.
+debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251

docs/as-built/architecture/coordination-primitive.md

@@ -86,6 +86,13 @@ Routes import these; services are Hono-free:
 - **`outbox-handler.ts`** — sender-side outbox: idempotent record, mark
   delivered/failed, list. Emits no event-bus events (pure audit).
 
+The standing detector in `queue-stuck-sweep.ts` creates findings through the
+queue repository, with `evidenceRef: rig queue show <source-qitem-id>` pointing
+to the underlying durable work row. This satisfies the existing human-route
+evidence contract without changing destination resolution: an admitted finding
+can still be unroutable. Repeated detections refresh the existing finding;
+when the source condition resolves, the sweep closes its own finding.
+
 ## 3. The hot-potato closure contract (where queue closure is enforced)
 
 `hot-potato-enforcer.ts` is the pure validator for the load-bearing API

docs/as-built/architecture/transport-and-transcripts.md

@@ -97,7 +97,7 @@ present @HEAD.
 2. Check mid-work state (unless `--force`) — re-confirmed
    `session-transport.ts:136-141` (`findPatternEvidence(recentLines,
    MID_WORK_PATTERNS)`); legacy mid-work check at `:666`.
-3. Two-step tmux send: `send-keys -l` → ~200ms delay → `C-m`
+3. Two-step tmux send: a unique file/buffer pasted with `paste-buffer -d -r -p` at every payload size → ~200ms delay → separate `C-m`. Bracketed paste preserves multiline input in supporting TUIs; the payload never enters a shell argument. A successful paste proves transport execution, not runtime consumption.
    (`session-transport.ts:717` submits `C-m`).
 4. Optional `--verify`: capture post-send pane, check message visibility
    (`session-transport.ts:305` `verify?`; `:694` `if (opts?.verify)`).

docs/as-built/architecture/workflow-runtime.md

@@ -342,19 +342,44 @@ and the flow resumes from where it stopped.
   settings key): target resolution = spec per-class → spec default →
   host dynamic key → ORCHESTRATOR-FIRST (the declared orchestrator
   role via the same `preferred_targets` pick step owners use) →
-  `human@host` never-lost fallback. THE TIER SPLIT: `human-gate` rides
+  registered-human selection (`workflow-human-destination.ts`). THE TIER SPLIT: `human-gate` rides
   ONLY human-routed positions — an orchestrator-routed item carries
   the ordinary tier so the shipped attention union (which matches on
   tier regardless of destination) never leaks it into NEEDS-YOU. The
   shipped attention predicate is untouched.
-- **Class (a) born-in-txn**: the projector's failed-terminal branch
-  creates the item INSIDE the failing transaction — no window where
-  the instance is failed and no item exists; a gate-rejected routed
-  destination re-creates on `human@host` (never lost, never fails the
-  close). **Class (b) at detection**: the boot sweep and the keepalive
+- **Class (a) born-in-txn**: serial failure and unhandled dependency-branch
+  failure share exception admission. The failed packet, dependency occurrence,
+  owning item and staged wake commit together, even while an unrelated frontier
+  keeps the instance active. Mapped remediation remains ordinary workflow work;
+  an unmapped or max-hop failure requires an owner. An agent destination rejected
+  as an unknown rig tries registered-human selection. Selection, admission,
+  or storage failure rolls back the close; it never commits a phantom
+  human alert. Other errors retain their original diagnosis. **Class (b) at detection**: the boot sweep and the keepalive
   evaluation call the injected ensurer (`workflow-exception-
   escalation.ts`) — occurrence-deduped against OPEN items by tag
-  query; the crash-surviving sweep re-creates a missed item.
+  query, scoped to the exact workflow, instance and packet; the crash-surviving
+  sweep re-creates a missed item. Normal projection, keepalive (including
+  healthy/terminal returns), and boot (including completed instances) reconcile
+  each overdue item's own packet. A resolved wait, completion or obsolete
+  frontier packet closes only that occurrence with a retained transition;
+  an overdue sibling stays open. Unknown provenance is retained. A later
+  overdue episode can create a fresh item even when it reuses the same packet.
+- **Human selection and failure**: the existing `workspace.operator_seat_name`
+  setting selects a registered human; when unset, exactly one registered human
+  is required. No `human@host` alias is invented and no arbitrary choice is made
+  among several humans. The setting and registry are read at fallback time,
+  so a valid configured agent route needs no human registry. Missing, ambiguous,
+  invalid or unavailable selection produces `workflow_human_destination_unavailable`
+  (HTTP 409 for failed projection). Fix the registration/selection and retry.
+  Detection-time admission failures are logged by boot and included in the
+  keepalive's existing owner nudge and evaluation notes; later detection retries.
+  A registered destination still uses the gateway's ordinary delivery rules and
+  receipt ledger. Admission is not proof of posting or readership.
+  A capability inventory or detector instance-binding read failure propagates
+  instead of becoming a no-match:
+  failed projection returns HTTP 500 and rolls back its packet, instance and
+  history writes; overdue detection surfaces the read error without an exception
+  item. An evidenced no-match still uses registered-human selection.
 - **`resume`** (`POST /api/workflow/:id/resume`, runtime `resume()`,
   `rig workflow resume`): redrive semantics in ONE scribe transaction —
   failed→active REBOUND to the recorded failed step; the owner is
@@ -362,7 +387,12 @@ and the flow resumes from where it stopped.
   stale destination — resume is the one sanctioned re-resolution
   point); `--decision` lands durably in the redrive packet; the
   occurrence's open items close with provenance; the trail is
-  preserved, never rewritten. THE LIVELOCK RAIL (migration 051):
+  preserved, never rewritten. For a dependency graph, `--occurrence <failed-qitem-id>`
+  selects the episode (required with several unresolved failures). Its resolution,
+  redrive packet/wake and exact instance/occurrence exception closure share one
+  transaction; siblings remain intact. An identical occurrence/decision retry
+  returns the existing redrive; changed decision bytes conflict without mutation.
+  THE LIVELOCK RAIL (migration 051):
   `hops_baseline` re-anchors the max_hops guard at resume so each
   redrive gets exactly one bounded window; `resume_count` is the
   recorded redrive fact; re-exceeding raises an honest NEW occurrence.
@@ -427,8 +457,8 @@ spec — the self-driving factory's binding substrate. Three seams:
   no live resolution of future steps; a warming rig instantiates), and
   resume. The WF-5 exception dial's orchestrator-role position resolves
   capability-aware on the bound rig at both homes (in-txn class-(a) +
-  detection-time class-(b)), non-throwing with the human@host
-  never-lost fallback. Failures are loud-with-candidates: structured
+  detection-time class-(b)), then uses registered-human selection if no
+  agent resolves. Failures are loud-with-candidates: structured
   per-candidate disqualifiers + a named zero-candidate message; never a
   spawn, never auto-`add_member`, never a dead-seat route. Additive
   `owner_resolution` trail evidence records `{mode, role, boundRig?,

docs/as-built/cli-reference.md

@@ -23,8 +23,151 @@ Verified against the shipped CLI on 2026-06-15 (v0.3.4) using:
 
 This document reflects the current `rig` surface as shipped. Where live help text is narrower than the implementation, notes call that out explicitly.
 
+## Terminal dashboard entry
+
+The TUI's **Connections** section (`connections` or `:connections`) shows
+running daemon and launching CLI identity, selected instance settings with
+source, observed rigs and authored Specs, Slack configuration and running wire
+state, and registered humans with primary/secondary bindings. `back` restores
+the work view that opened Connections. The view supplies supported CLI guidance;
+it does not enable a connector, change settings, or send a test message.
+
+Connections reads the passive `GET /api/gateway/connections` projection. It
+selects safe fields from settings, config, the human registry and gateway status;
+secret values/references and raw errors are omitted. Current config is compared
+with the wire's activation digest when available. Last Slack verification comes
+from at most 64 KiB of the existing channel-operation audit tail, matched to the
+current configuration and labeled with its time/actor. It is historical scope
+and channel-membership evidence, not current reachability, credential identity,
+delivery or readership. Missing, failed, incomplete and changed observations
+remain distinct; an older daemon without the projection reads as unavailable.
+Use the displayed guidance on that instance; `rig slack verify --json` explicitly
+contacts Slack. Ordinary navigation/refresh does not.
+
+`rig tui` opens an independent TUI through the same front door as bare `rig`.
+`rig tui --shared` requires interactive input/output and a loopback daemon
+connection. It resolves the kernel's bound `operator.human` terminal and
+attaches a local tmux client without starting a seat or another TUI. Ctrl-b,
+then d detaches; reattaching preserves navigation. A missing or ambiguous
+binding fails with inspection guidance instead of creating another kernel.
+
+Fresh kernel terminals start `rig tui` automatically. Older terminals, or a
+terminal where the TUI was quit, retain their shell: run `rig tui` there once.
+The kernel view uses TUI instance `kernel`; standalone uses its ordinary
+instance. `rig tui commands --json` exposes the command registry for agent
+control. In the ordinary shell, Tab completes command names/aliases, section
+jumps and arguments from the current snapshot. Ambiguous prefixes show candidates;
+keep typing and press Tab again. No match preserves the text. Enter executes;
+Escape clears. Free-text filters are not completed. Bracketed paste is text, never
+an implicit command submission.
+
+Recent shows ordered, wrapped queue changes. Enter on an event opens the original
+record (including its raw timestamp); Escape returns to the previous view/scroll.
+Recorded changes remain attributed claims, including attempts and failures.
+
+Absolute TUI times use `ui.timezone`, default `America/Los_Angeles`, with native
+daylight-saving rules. Run `timezone` in the TUI for the current value and settings
+guidance. `rig config set ui.timezone Europe/London` persists an alternative;
+`rig config reset ui.timezone` restores the default. Reopen the TUI after changing
+it. `OPENRIG_UI_TIMEZONE` overrides the file setting. Invalid settings produce a
+visible fallback notice. Relative ages and stored source timestamps are unchanged.
+
+See [the first-use journey](../reference/getting-started.md).
+
+## Daemon shutdown
+
+`rig daemon stop` sends at most one SIGTERM to a live daemon identified by its
+local state.
+An explicit `OPENRIG_URL` that disagrees with that target refuses before signaling.
+The daemon has one referenced **10-second** budget covering asynchronous service
+shutdown, connections and recorder drain; repeated SIGINT/SIGTERM joins that stop.
+The CLI allows **12 seconds** for process exit, then verifies the original PID and
+listener even if `daemon.json` was removed. A refused listener, a responding
+listener and an unavailable probe are different outcomes.
+
+`$OPENRIG_HOME/daemon-shutdown.json` records the PID, shutdown start/completion,
+phase, failures and `clean|failed|timed-out` outcome. Only successful drains mark
+the lifecycle record clean. A failed/timed-out drain returns nonzero, including
+after the process exits. For a recorded target, missing or stale receipt evidence
+is unverified and also returns nonzero. Failed/unverified stops retain target
+state for retries; status reads only clean it after a matching clean receipt.
+An already-exited target uses the same receipt judgment without another signal.
+With no recorded target and a refused listener, the CLI reports a distinct
+no-target no-op, not a clean-drain verdict. Unbound incomplete or unreadable
+local shutdown evidence remains nonzero/unverified rather than being attributed
+to an unrelated listener.
+
+Older daemons without the receipt can therefore be proven stopped without their
+graceful drain being certified. Inspect the receipt and `daemon.log`;
+do not infer that pending external work completed or was rolled back, or retry it
+blindly. The bound covers asynchronous waits, not a synchronous event-loop wedge.
+
+## Human delivery
+
+`rig gateway human list --json` discovers registered `<entityId>@external`
+addresses. `rig gateway human show <entityId> --json` includes primary-connector
+readiness, reason and next inspection. Project policy decides when to contact a
+human; `messaging-the-human` supplies the transport mechanics.
+
+Create a human request with `rig queue create --destination <address> --summary
+"<decision>" --body-file <file> --evidence-ref <ref> --verify --json`. It persists
+one row before checking the delivery receipt. `posted` proves connector
+acceptance, never readership; `transport-failed`, `never-posted`, `still-pending`
+and `indeterminate` preserve the request and name the next inspection. Do not
+blindly repeat the create. `rig send` is for agent seats.
+
+`rig slack manifest [--url|--json]` (experimental in 0.6.0) prints the Slack app manifest a user creates
+their own private Socket Mode app from, offline (no daemon, tokens or network).
+`--url` is Slack's create-app link with the manifest prefilled; `--json` adds the
+scope and event lists and why each scope is requested. The same object is served
+read-only at `GET /api/gateway/slack/manifest` for the TUI Connections page. Setup
+steps: `docs/reference/slack-app-setup.md`.
+
+`rig slack enable [--reason <reason>]` seeds existing backlog only on a disabled
+to enabled transition. Repeating enable does not reseed or restart. `rig slack
+disable --reason <reason>` requires a shutdown reason. Both return attributed
+lifecycle receipts; direct requests can name `actor` when no managed-session
+header exists. Header-derived and claimed identities remain distinct.
+Configuration, verification and human-binding edits also record actor, reason,
+prior/result state and effect in
+`$OPENRIG_HOME/state/human-channel-operations.jsonl`. Each operation has a start
+and a completion receipt with one ID; a missing completion is indeterminate.
+Snapshots retain state/digests rather than credentials or message bodies. Local
+CLI configuration/verification/binding receipts are explicitly `claimed:v1`.
+
+`rig host pair <url> [--human <address>]` selects the sole registered target
+human, or requires an explicit selection when several exist. A missing registry
+or ambiguous recipient refuses before creating an approval. An unset
+`workspace.operator_seat_name` no longer invents a username-derived kernel
+seat: Mission Control discovers a single registered human or shows identity
+uncertainty. Explicit existing seat selections remain supported. Legacy aliases
+resolve only when their entity is registered; old failed rows are preserved,
+not implicitly delivered or replayed by registration.
+
 ## Overview
 
+System Health diagnosis, policy, checkpoints, and dispositions are documented in
+[Agent-operated System Health diagnosis](../reference/health-diagnosis.md).
+Diagnosis `show`/`list --json` are summaries; use `--full --json` for the previous
+complete evidence payload. Their defaults identify omitted fields and the exact
+expansion command. Workflow human views remain summaries; workflow `--json`
+continues to return the complete API payload.
+
+For raw JSON evidence files, CLI read defaults cannot intercept `cat` or a Node
+print. Inspect size and keys before selecting needed fields; retain full evidence
+on disk. For example:
+
+```sh
+wc -c < receipt.json
+jq 'keys' receipt.json
+jq '{gate, judge, cutSha, surfaceCount, overallPackageVerdict}' receipt.json
+```
+
+Select the actual fields present in that file. Redirect intentional full CLI
+output to a file before inspecting selected fields; use `set -o pipefail` when
+piping a command so a formatter cannot hide its failing exit.
+
+
 - Binary: `rig`
 - Top-level command groups: `64`
 - Output mode: human-readable by default; many commands also support `--json`
@@ -121,8 +264,29 @@ Notes:
   path. Direct daemon first start uses the same initializer. Existing files are
   preserved and wrong-type managed paths are refused before any write. See
   `docs/reference/instance-layout.md`.
+- Startup uses a local `daemon-start.lock` reservation before instance initialization,
+  shared by `daemon start`, `start`, and `up`. A concurrent supported launch fails
+  without spawning another daemon or running its pre-bind database initialization.
+  Success requires the spawned child's numeric PID from `/healthz` at every required
+  listener and a live child through atomic `daemon.json` publication. Missing or
+  mismatched process identity, an invalid listener plan, child exit, and unresolved
+  probes cannot publish success. Use a matching CLI/daemon pair; a legacy endpoint
+  without PID evidence is insufficient. This local reservation does not serialize
+  old binaries or direct execution of the daemon entrypoint.
+- Startup checks physical liveness after the synchronous state writer as well as
+  before it; queued child events alone cannot prove that boundary. If publication
+  fails verification, startup rejects and withdraws only state matching this
+  launch's PID, start time, listener and DB. It never removes a replacement owner.
+- Failed process inspection is uncertainty, not proof that a child exited. Cleanup
+  waits for the owned child's exit evidence; an error event is insufficient.
+- Failed startup signals only its own child and waits boundedly for its exit. If
+  cleanup cannot be confirmed, the reservation remains and the error names the PID.
+  An interrupted launcher can also leave `daemon-start.lock`. Inspect its recorded
+  launcher/child PIDs, `daemon.json`, and `daemon.log`; only after proving both
+  processes absent, archive that reservation before retrying. There is no timed
+  takeover: a dead launcher may have left a live, unbound child.
 - `logs` reads daemon log output and can follow it.
-- **Deploy identity (v0.4.4, OPR.0.4.4.11 FR-6/7)**: a PACKAGED build (built via `scripts/build-package.sh`) is stamped with `{semver, commit, dirty, builtAt}`; the daemon's `/healthz` payload carries the four stamp fields additively and `rig --version` renders `<semver> (<commit8>[, dirty])`. A source/dev run has NO stamp and adds NOTHING (never an invented SHA) — `/healthz` keeps its legacy body and `--version` prints the plain semver. This is the 30-second stale-deploy diagnostic: an unstamped or old-commit `/healthz` on a long-running host means you are looking at an older deployed build, not the source tree. Source: `packages/{daemon,cli}/src/build-info.ts` (`stampFields`), `packages/daemon/src/server.ts` (`/healthz`), `packages/cli/src/version.ts`.
+- **Deploy identity (v0.4.4, OPR.0.4.4.11 FR-6/7)**: a PACKAGED build (built via `scripts/build-package.sh`) is stamped with `{semver, commit, dirty, builtAt}`; the daemon's `/healthz` payload carries the four stamp fields additively and `rig --version` renders `<semver> (<commit8>[, dirty])`. A source/dev run has no build stamp (never an invented SHA); `/healthz` still reports its runtime PID and `--version` prints the plain semver. This is the 30-second stale-deploy diagnostic: an unstamped or old-commit `/healthz` on a long-running host means you are looking at an older deployed build, not the source tree. Source: `packages/{daemon,cli}/src/build-info.ts` (`stampFields`), `packages/daemon/src/server.ts` (`/healthz`), `packages/cli/src/version.ts`.
 
 ### `rig status`
 
@@ -738,6 +902,21 @@ Notes:
 - `--snapshot-id <id>` selects one exact restore-usable snapshot instead of
   applying the automatic choice. `--plan` previews a multi-seat subset and its
   non-target effects without mutation.
+- `rig launch <rigId> <nodeRef> --retry-startup-from <member-file> --rig-root <absolute-source-root>`
+  explicitly retries an added agent whose first start failed during resource
+  projection, before a native conversation began and before startup context was
+  saved. First correct the projection failure, exit the failed shell normally,
+  and use `rig seat clean <seat> --reason <reason>` after it is stopped. Supply
+  the original bare or `{member: ...}` YAML/JSON fragment, without edges or
+  member startup/continuity overrides. The agent source hash and retained
+  identity, model, cwd and policy must agree. The retry uses normal validation,
+  projection and required startup delivery on the same node; it preserves other
+  seats and prior failures. It refuses bound, live, indeterminate or previously
+  native sessions. This is not snapshot restore or a substitute for deliberate
+  fresh launch, and cannot combine with snapshot, subset or plan options.
+  The operator is responsible for supplying the complete original fragment:
+  retained state cannot reconstruct missing member, pod or rig instructions.
+  Never strip unsupported overrides to make a retry pass.
 
 ### `rig remove`
 
@@ -756,6 +935,22 @@ Notes:
 
 ## Identity, Communication, and Context
 
+### `rig startup-proof submit`
+
+Usage: `rig startup-proof submit --challenge-id <id> --answer <answer> [--json]`
+
+Submits the selected startup exercise through the authenticated activity hook,
+using the current seat's identity and the challenge supplied in its startup
+prompt. A correct current answer returns `oriented: verified`; a bare
+acknowledgement, wrong answer, or stale challenge fails. Startup readiness alone
+does not verify orientation.
+
+An extra exercise is opt-in through a `startup_proof` startup action with
+`value: authenticated` and `idempotent: true`. Omission adds no exercise, and a
+later applicable `value: none` selects lean startup. See
+[startup proof selection](../reference/rig-spec.md#startup-proof-selection)
+for the full authoring and restore rules. Terminal nodes receive no challenge.
+
 ### `rig whoami`
 
 Usage: `rig whoami [--node-id <id>] [--session <name>] [--host <id>] [--full | --verbose] [--json]`
@@ -832,6 +1027,11 @@ Notes:
 - `--through` accepts either one path-like context ref or an ordered list of existing local files; mixing the two forms is rejected.
 - Sends one piece at a time through the normal transport and waits `--pace` between pieces (default `10s`; duration overrides require an explicit `ms` or `s` suffix). The same explicit-unit grammar applies to `--consume-timeout`, `--consume-poll`, and `--turn-timeout`; bare numbers are refused. There is no trailing delay.
 - A missing local file or missing/unreadable ref member aborts before the first send, so a walk delivers every piece or none.
+- Where a generation record resolves, each piece must appear as a complete user message in the newly appended record and its corresponding native turn must close before the next piece. Only CRLF line endings and surrounding whitespace are normalized; internal whitespace, missing middles, shared prefixes, and tails do not qualify.
+- Claude closure follows the message's UUID ancestry through an assistant response to `turn_duration`. Codex uses a `response_item` user message within a named `task_started`/`task_complete` turn; queued input or a different turn's completion is insufficient. These receipts prove delivery and turn completion, not semantic comprehension.
+- Codex generation lookup joins the bound process's post-start log thread IDs to retained native CLI conversations. Auxiliary title threads cannot replace that identity; zero or multiple matching conversations remain unverified instead of being selected by recency.
+- Codex records resolve through the verified current pane/process and native thread table, including before token telemetry exists. The rollout header must identify that thread. Missing or ambiguous identity is reported as unverified. A generation/file replacement or unreadable record during a verified walk aborts it; it never silently continues into a replacement occupant.
+- `--json` reports `consumptionVerified`. If the initial generation-record probe is unavailable, legacy delivery remains possible with an explicit unverified advisory and `consumptionVerified: false`.
 
 ### Cross-host execution (`--host <id>`)
 
@@ -840,6 +1040,21 @@ commands use single-hop SSH CLI-side shell-out; HTTP-transport commands talk to
 the remote daemon API. The local daemon is not involved in SSH routing. The
 remote host is expected to have its own managed `rig` available on `$PATH`.
 
+HTTP sender attribution uses the originating instance's persisted self-host
+identity, read without creating or changing its database. Explicit DB config
+wins; otherwise the last daemon launch's DB selection is retained. This works
+while the local daemon is stopped. The destination's identity and the configured
+display name are never used as the origin.
+
+Ordinary local requests retain bare seat names. For an explicit `OPENRIG_URL`
+(or legacy `RIGGED_URL`), a bounded health probe preserves bare addressing only
+when the target's self-host identity matches the local one. A different,
+unavailable, or ambiguous target—including a loopback forwarding endpoint—gets
+the known origin suffix. Already-qualified senders remain unchanged. If the
+local origin cannot be read, delivery proceeds with `origin-unknown:v1`
+provenance and a diagnostic after a successful response; queue forwarding
+preserves that uncertainty rather than attributing the sender to the relay.
+
 Hosts are declared by the operator in `~/.openrig/hosts.yaml`:
 
 ```yaml
@@ -1086,7 +1301,7 @@ Subcommands:
   - Pipeline use must enable `set -o pipefail`; otherwise the shell reports only the downstream formatter's status and can mask a nonzero `rig` read such as a timeout.
   - `--destination <s>` / `--source <s>` / `--state <csv>` keep working and compose with the new flags.
   - The four axes (scope × history × field-breadth × encoding) are orthogonal and composable. The bare unscoped firehose that aggregated cross-rig + full-history (~64,000 tokens on the live host) is retired as a default — opt-in via `-A -a --full`.
-  - Use `rig queue show <qitemId>` for the full single-item view (kubectl `describe` / docker `inspect` pattern).
+  - Use `rig queue show <qitemId>` for the body preview; `rig queue show <qitemId> --full --json` returns the original complete record. Preview JSON adds `readView` with completeness, omitted content, full JSON byte size and the exact expansion command.
 - `overdue [--json]` — in-progress qitems past closure_required_at
 - `inbox-drop <destinationSession> --sender <session> (--body <text> | --body-file <path>) [--tags <csv>] [--urgency <u>] [--audit <pointer>] [--id <inboxId>] [--json]`
 - `inbox-absorb <inboxId> --receiver <session> [--json]` — promote a pending inbox entry to a queue_item
@@ -1166,15 +1381,16 @@ Usage: `rig project <subcommand>` — L2 agent-backed classifier with daemon-enf
 
 Subcommands:
 - `lease-acquire [options]` — acquire the active classifier lease for the caller.
-- `lease-heartbeat [options]` — send a heartbeat for an active classifier lease (extends TTL).
+- `lease-heartbeat [options]` — send a heartbeat for an active classifier lease (extends TTL). A lease already past its TTL refuses with `lease_expired`; acquire again instead.
 - `lease-show [options]` — show the currently-active classifier lease.
 - `reclaim-classifier [options]` — operator verb to reclaim the active classifier lease. Use `--if-dead` to refuse if holder is still alive.
-- `classify <streamItemId> [options]` — project a stream item with classification fields. Idempotent on `stream_item_id`; requires an active lease.
-- `list [options]` — list project classifications with filters.
+- `classify <streamItemId> [options]` — project a stream item with classification fields. Idempotent on `stream_item_id` (first write wins). Requires `--lease-id`: the result is refused (`lease_mismatch`, `lease_expired`, `lease_held`) unless that exact lease is active, unexpired and held by `--session` at write time. Optional `--area`, `--scope-ref` (with `--candidate-set-version`), `--duplicate-of`, `--needs-human true|false` (omit when unknown), `--classifier-version`, `--taxonomy-version`, `--attempt-id` with `--execution-id`. Without `--attempt-id` the result is a manual classification, not bound to the attempt ledger. Every supplied field must be a string (IDs and versions non-empty); `--needs-human` omitted means unknown.
+- `list [options]` — list project classifications with filters (`--session`, `--destination`, `--area`, `--scope-ref`, `--needs-human true|false|unknown`).
 - `show <projectId> [options]` — show one project classification.
 
 Notes:
-- Lease semantics: only one classifier holds the active lease at a time. Heartbeats extend TTL; lease expiry frees the slot for the next acquirer.
+- Lease semantics: only one classifier holds the active lease at a time. Heartbeats extend TTL only while the lease is unexpired. Re-acquiring your own expired lease issues a new lease id, so results bound to the old id are refused; another session must use `--evaluate-deadness-first` or the reclaim verb.
+- Attempt ledger (daemon HTTP, used by a classifier occupant): `POST /api/projects/attempts/begin`, `/attempts/:id/abstain`, `/attempts/:id/fail`, `GET /api/projects/eligible`. Abstentions and errors are recorded there, never in the classification row; errors retry with bounded backoff, then end `exhausted`. Every `begin` (including a timeout or error retry) returns a new `executionId`; only the current one can abstain, fail or bind a result (`attempt_superseded` otherwise), because a renewable lease never proves an older execution stopped.
 - `classify` enforces L1→L2 foreign-key existence: the referenced `stream_items` row must exist or the call is rejected before any state mutation.
 - `reclaim-classifier` is the operator-side verb to recover from a hung classifier; `--if-dead` adds a liveness guard so a still-heartbeating classifier is not stolen from.
 
@@ -1229,11 +1445,194 @@ Phase D extends the policy enum with `workflow-keepalive` (the policy deferred f
 - `project --instance <id> --current-packet <qitem-id> --exit <handoff|waiting|done|failed> --actor-session <session>` — close the current packet AND project the next-step packet IN THE SAME daemon transaction (transactional-scribe; lost handoffs impossible by design). `--result-note <text>`, `--blocked-on <ref>`, `--next-owner <session>` modify behavior.
 - `list [--status <s>]` — list instances; optionally filter by status (`active`/`waiting`/`completed`/`failed`).
 - `show <instanceId>` — show one instance.
+- `revise <instanceId>` — inspect authored versus bound lifecycle input without
+  writing. The result names changed sources/steps, composition, compatibility,
+  and an apply command containing the inspected version, digest and operation
+  key. Fill in the actor and decision before using `--apply`.
+- `operation <key>` — recover the original lifecycle creation or revision
+  receipt and current instance after a lost response or later source edit.
 - `trace <instanceId>` — show the instance + its append-only step trail (audit-only).
 - `continue <instanceId>` — idempotent inspector; in v1 returns the current state.
 
 The owner-as-author + workflow-as-transactional-scribe contract is enforced by the daemon. The owner of a packet decides when it closes; the workflow runtime atomically records the closure AND creates/projects the next qitem per the workflow spec, in a single daemon transaction.
 
+### Project-owned release profiles
+
+`project.lifecycle.profile` selects a key in `project.lifecycle.profiles`. Each
+selected entry contains `required_steps` (a nonempty list of stable obligation
+IDs) and `workflow` (the ordinary workflow language). The reusable example at
+[`project-release-profile.yaml`](../reference/project-release-profile.yaml)
+names nine release-ceremony stages followed by one `release-boundary` judgment.
+That final judgment covers the seven areas of the canonical
+[`release-boundary.md`](../reference/release-boundary.md) checklist in one
+agent-authored record. It does not create seven automatic gates.
+
+Put the profile in `project.yaml` once; release missions need only their ordinary
+composition. Customize the example's project ID, roles, and policy for the
+project. Every profile step declares `depends_on` (including `[]` on roots);
+conditional `next_hop.on` jumps are refused so required stages cannot be bypassed.
+Missing required IDs refuse with `lifecycle_required_step_missing`.
+Prerequisite cycles make compilation ineligible with `dependency_cycle`, even
+when `loop_guards.max_hops` is set. That guard bounds routing loops; it cannot
+make mutually dependent steps ready.
+
+Precedence is explicit:
+
+- With a selected project graph and no mission workflow, the mission inherits it.
+- `mission.lifecycle: {profile: <same-profile>, mode: extend, workflow: ...}` adds
+  new steps, merges roles by name, and appends context references. An extension
+  cannot replace a step ID; its workflow accepts only `steps`, `roles`, and
+  `context_refs`.
+- `mode: override` supplies a replacement workflow. All required project step IDs
+  and the prerequisite relationships between them must remain. Additional
+  intermediate stages are allowed. An omitted or unknown mode with competing
+  workflows refuses with `lifecycle_override_ambiguous`.
+- Without `project.lifecycle.profiles`, the existing mission-authored workflow
+  takes precedence over slice execution declarations. This legacy path remains
+  supported and reports an advisory that no project graph is selected. Adding a
+  project graph to an existing copied mission workflow requires explicit mode
+  selection or removal of the copy. Project lifecycle fields such as an inert
+  `workflow` or `workflow_ref` are refused rather than silently ignored.
+
+An authored, ready successor may be a mission extension step depending on
+`release-boundary`. Without that extension, `release-boundary` exits `done` and
+finishes the current lifecycle. The runtime creates the continuation packet;
+the agent judges readiness and performs any authorized activation. It does not
+infer readiness from a folder or activate future scope automatically.
+
+Compilation exposes `graphSource` (selection mode, project/mission addresses,
+required IDs), the complete `workflowSpec`, dependencies, and source digests.
+These are bound into the compiled input digest and persisted at instantiation.
+Changing source bytes under an existing operation key refuses. Relative paths
+passed to both CLI `compile` and `instantiate-lifecycle` are resolved against the
+**caller cwd before HTTP**, so daemon cwd cannot change their meaning.
+
+`workflow guidance <instance> [--packet <qitem>] [--component <id>] [--full]`
+reads current selected SDLC teaching and original SPEC intent. `workflow show`
+and `workflow continue` expose the same guidance. Entry, handoff, route and resume
+packets carry a compact preview; existing admitted wait notices refresh it at
+send time. Healthy waiting does not read or inject the catalog on every tick.
+
+Selection follows project → mission → explicit active slice (or a legacy slice's
+exact executable identity). A narrower component list replaces ancestor components
+and edges; an omitted catalog inherits. Bound member lists alone do not select an
+active slice. Catalog addresses use the shared H2/H3 resolver: absolute or
+`$OPENRIG_HOME` paths, paths relative to the declaring manifest, `root: repository`
+from that manifest's Git tree, or a file declared by the installed context library.
+Missing/ambiguous components and unavailable sources are named unknowns; prose
+stays verbatim and has no required semantic field ontology.
+
+Compact guidance previews one component, using exact owner matches where possible;
+otherwise it labels a menu preview. Position remains unknown: neither array order,
+clock nor handoff infers method progress. `--full` expands components relevant to
+current packet custody (all selected components when none match); `--component`
+chooses one explicitly. Whole oversized prose blocks are omitted with an expansion
+notice, so a clipped caveat never masquerades as complete teaching.
+
+Guidance reports manifest hashes against the lifecycle binding and the current
+catalog hash. Referenced prose is current authored advice, not a cached executable
+snapshot. YAML selection edits use the existing revision path; catalog-only prose
+changes refresh on read without creating work or a new revision store. Reading
+advice, receiving a notice and independent acceptance remain distinct.
+
+`workflow show`, read-only `workflow revise`, and the TUI distinguish current,
+source-only, compatible, incompatible and unavailable authored comparisons.
+Catalog or membership bytes can change without changing executable steps;
+file edits do not silently adopt either kind of change. A supported `revise
+--apply` preserves completed/live steps, required obligations, queue custody and
+prior receipts while adopting future-step changes on the same instance. It
+requires the inspected version/digest, a stable operation key, actor and reason.
+Changed completed/live steps, removed obligations and unsupported migrations
+refuse with a specific explanation; restore the protected contract and revise
+unstarted successors. After an ambiguous response, inspect `workflow operation
+<key>` or retry the identical apply command to recover its one committed effect.
+
+Mission-bound continuation and wait guidance carries a snapshot of authored
+planning, wave admission/review and integration rules, with a pointer to inspect
+the current source before deciding. Waves guide agents; executable dependencies
+schedule steps. Bound slice sources do not automatically create child workflows.
+The execution view also reads current arrangement guidance into `planning_guidance`
+with exact source fields. Ordinary mission/wave/slice inspection keeps admission,
+review and accepted-core/full-contract guidance distinct from executable edges,
+attributed proof and current custody; prose does not create those facts.
+
+`workflow show`/JSON and the TUI execution view show every named obligation with
+its state and receipt state. Required steps need `project --evidence-ref <ref>`
+on a successful `done`/`handoff` exit; missing references refuse before mutation
+with `lifecycle_receipt_required`. Waiting and failed exits remain available.
+The projection records who supplied the reference and when. `recorded` means an
+attributed workflow receipt exists, not that the daemon verified its substance.
+An ordinary terminal queue row never supplies that receipt. Agents inspect the
+actual evidence, including reasoned not-applicable or deferred boundary areas.
+Existing typed `acceptance` contracts remain separate and retain their checks.
+
+### Authored mission boundary (legacy)
+
+Without a project-owned graph, when a mission declares `lifecycle.workflow`, `compile` uses that explicit
+workflow instead of deriving steps from active slices. Slice membership and
+backlinks are still validated and included in provenance; slice SDLC selections
+do not add workflow steps or gates. `lifecycle.profile` must match the profile
+selected in `project.yaml`:
+
+```yaml
+# Add to mission.yaml; project.yaml already selects release-boundary-v0.
+lifecycle:
+  profile: release-boundary-v0
+  workflow:
+    context_refs: [SPEC.md, PROGRESS.md, NOTES.md]
+    entry: {role: orchestrator}
+    roles:
+      orchestrator: {preferred_targets: [orch@my-rig]}
+    steps:
+      - id: mission-boundary
+        actor_role: orchestrator
+        objective: Inspect current evidence and decide the next authored exit.
+        allowed_exits: [waiting, done, failed]
+        re_present_after_seconds: 300
+        re_present_max_seconds: 3600
+```
+
+The nested `workflow` uses the ordinary workflow language; its ID defaults to
+`lifecycle-<project>-<mission>`, and its compiled version is derived from source
+digests. Boundary steps explicitly allowing `waiting` default to a five-minute
+initial reminder and a one-hour cap; both fields in the example override those
+defaults. Missing operation identity leaves compilation ineligible. Instantiation
+with one opaque `--operation-key` persists the compiled input digest and lifecycle
+binding; exact replay returns the same instance/entry packet, and changed input
+under that key refuses. Authoring alone never starts an instance.
+
+`context_refs` carries addresses in entry, successor, route/resume, and reminder
+packets. The lifecycle compiler also includes the project/mission manifests and
+`project.install.context`. Relative project references resolve from the project
+root; profile workflow references resolve from the project root and mission workflow
+references from the mission directory. References
+are not evidence verdicts: the receiving agent opens current context, may inspect
+beyond it, and chooses the exit. The daemon neither interprets receipts nor
+activates a mission. `rigx project` remains a separate manual shadow.
+
+Outside mission-boundary compilation, an unmapped `waiting` exit with
+`re_present_after_seconds` alone remains one-shot.
+Adding `re_present_max_seconds` opts into an existing queue/watchdog timer that
+repeats with exponential backoff: the example waits 5, 10, 20, 40, then 60 minutes
+between reminders. The cap must be an integer at least as large as the initial
+delay. No new packet is created. Repeated waiting acknowledgments retain the
+schedule; changed structured `closureEvidence` or a new blocker resets it.
+`rig workflow project --evidence-ref <ref>` records an attributed reference as
+closure evidence, without interpreting it or substituting for typed acceptance. Omitted
+evidence preserves the prior evidence, and object key order is immaterial.
+
+A transition on the exact qitem blocker makes the reminder due on the next
+scheduler tick (normally within one second), resetting the initial delay.
+Wake delivery receipts do not count as progress. The workflow's own waiting
+acknowledgments are on its frontier packet, not its upstream blocker; a repeating
+wait cannot name itself as its blocker. Blocker completion retains native
+queue unpark/wake behavior. Terminal or rerouted packets retire their timer.
+Restart reconciles blocker transition identity and resumes the persisted delay;
+replaying the same transition does not create another wake. A live repeating
+timer can have an unconsumed wake: these are separate facts in park status.
+Hard human gates are authored using the existing `gate` field; a reminder does
+not manufacture a gate or satisfy one.
+
 ## Operational Inspection
 
 Read-only inspection commands for compaction planning, workflow heartbeat, and seat handover observability. Default mode is read-only across this section.
@@ -1310,20 +1709,53 @@ Notes:
 Usage: `rig context <subcommand>` — browse, preview, compose, and manage operator-authored context packs. This noun never delivers; delivery belongs to `send`, `broadcast`, `walk`, and `queue create`.
 
 Subcommands:
-- `work-install [--project <id>] [--mission <id>] [--slice <id>] [--deliver] [--runtime <claude-code|codex>] [--cwd <agent-working-directory>] [--topology <ids>] [--apply-skills] [--json]` — resolve project/mission/slice Markdown plus `project.yaml install.skills` in one plan. With `--runtime`, composes system, topology, and project selectors and reports per-skill provenance/status; `--apply-skills` safely reconciles the owned harness projection into `--cwd` (default: the caller's current working directory), not the workspace metadata directory.
+- `work-install [--project <id>] [--mission <id>] [--slice <id>] [--deliver] [--runtime <claude-code|claude|codex>] [--cwd <agent-working-directory>] [--topology <ids>] [--apply-skills] [--json]` — resolve project/mission/slice Markdown plus `project.yaml install.skills` in one plan. With `--runtime`, composes system, topology, and project selectors and reports per-skill provenance/status; `--apply-skills` safely reconciles the owned harness projection into `--cwd` (default: the caller's current working directory), not the workspace metadata directory. Omitting `--runtime` skips skill inspection regardless of `OPENRIG_RUNTIME`; applying skills requires an explicit runtime.
+- `profile <name-or-ref> --situation <fresh|handover|post-compaction> [--runtime <claude-code|claude|codex>] [--profile <id>] [--budget <tokens>] [--rig <rig> --seat <seat>] [--mission <mission>] [--slice <slice>] [--json]` — compose the selected atom graph and explicitly granted context. Runtime defaults to `OPENRIG_RUNTIME`, otherwise Claude; an unknown nonempty environment value warns and falls back to Claude. An explicit flag overrides the environment.
 - `list [options]` — list all context packs in the library.
 - `show <name-or-ref> [options]` — show pack manifest + per-file metadata.
 - `preview <name-or-ref> [options]` — show the assembled bundle without delivering it.
 - `compose --out <ref> --from <files...>` — compose ordered files into a durable context ref without delivering it.
 - `sync [options]` — re-walk discovery roots and refresh the library index.
-- `add <source-dir> [options]` — install a context pack from a local directory into the configured context store.
+- `add <source> [--git] [--checkout] [--pack <relative-path>] [--name <ref>] [--json]` — install a directory/manifest URL, or clone a Git repository with `--git`. Git discovery checks the repository-root manifest and `.openrig/context-packs`; multiple packs require an explicit `--pack`. `--checkout` selects an existing local checkout whose branch may be merged by an update.
+- `source inspect <ref> [--json]` — distinguish the selected revision/digest, current served edits, checkout branch/revision/status/conflicts, and locally known upstream divergence. It does not fetch or prove consumption.
+- `source update <ref> [--json]` — explicitly fetch and merge the selected checkout branch’s upstream, then publish its clean declared pack inputs. Dirty checkouts or edited served selections stop before update. Conflicts/unavailable upstream retain the old served selection and both Git sides.
 - `rm <ref> [options]` — remove a context pack by its path-like ref.
 
 Notes:
 - Context packs are operator-authored bundles of context (manifest + files) intended to prime a managed seat with a coherent starting context.
+- Both `profile` and `work-install` accept `claude-code`, its alias `claude`, and `codex`. Invalid explicit values fail during CLI argument parsing, before context lookup or projection. JSON metadata retains the consumer's existing keys: `profile.runtime` is `claude` or `codex`; `skillProjection.runtime` is `claude-code` or `codex`. Both Claude spellings produce the same selection and metadata within each command; manifest runtime keys remain unchanged.
+- For example, `rig context profile world-public --situation fresh --runtime claude-code` and `rig context work-install --runtime claude-code` use the same runtime spelling. Profile atoms that read seat context still require both `--rig` and `--seat`.
 - `preview` is the canonical read-only way to inspect the assembled content.
 - This command family is delivery-free; context-window inspection is not part of this noun.
 
+Git source example (use the intended instance and existing Git credentials):
+
+```bash
+rig context add <repository-path-or-URL> --git --name team-world
+rig context source inspect team-world --json
+# Edit/commit in the reported checkout with ordinary Git.
+rig context source update team-world --json
+rig context get team-world
+```
+
+Git selections copy only `manifest.yaml` and its declared files into the existing
+context library; `.openrig-git-source.json` records the retained checkout, pack,
+revision, selection time and digest. The checkout and previous selections live
+beside the configured library under `<context.root>-git-checkouts` and
+`<context.root>-git-history`. They are retained when a selected pack is removed.
+Local-only inspection compares against cached upstream refs; only explicit update
+contacts the remote. Git uses existing credentials, with terminal prompting disabled
+and a 60-second command timeout; a failure retains the checkout for native Git diagnosis.
+
+Commit local improvements in the checkout before updating. If someone edited the
+served copy directly, preserve those edits in the checkout and commit them; restore
+the served copy to its recorded selection explicitly before retrying. No automatic
+stash, reset, rebase, push or conflict strategy runs. A merge conflict remains in the
+checkout for an owning author to resolve/commit or abort with Git. Only then retry
+update. Selected bytes, successful `context get`, and a consumer demonstrably using
+them are separate facts. This command does not automatically adopt context in other
+instances or prove that an agent consumed it.
+
 ### `rig workspace`
 
 Usage: `rig workspace <subcommand>` — Workspace Primitive (PL-007), v0 typed-kind tooling.

docs/reference/agent-spec.md

@@ -383,6 +383,12 @@ The startup block follows the same format as in the RigSpec (see `docs/reference
 
 Agent-level startup is applied to all profiles. Profile-level startup is applied only when that profile is active. Both merge additively via the startup layering model.
 
+An additional orientation challenge requires an explicit `startup_proof` action
+with `value: authenticated` and `idempotent: true`. Omission adds no exercise;
+a later applicable `value: none` overrides an earlier selection. See
+[startup proof selection](rig-spec.md#startup-proof-selection) for precedence,
+restore behavior, and the distinction between readiness and verified proof.
+
 ### Delivery Hint Quick Reference
 
 | Hint | When Delivered | Mechanism |
@@ -446,6 +452,6 @@ The only required file is `agent.yaml`. Everything else is referenced by paths i
 | `implementer` | `specs/agents/development/implementer/` | `shared` | openrig-user, development-team, test-driven-development, systematic-debugging, etc. | TDD implementation agent |
 | `qa` | `specs/agents/development/qa/` | `shared` | openrig-user, development-team, etc. | Quality assurance agent |
 | `orchestrator` | `specs/agents/orchestration/orchestrator/` | `shared` | openrig-user, orchestration-team, etc. | Rig orchestration lead |
-| `reviewer` | `specs/agents/review/reviewer/` | `shared` | openrig-user, review-team, etc. | Independent code reviewer |
+| `independent-reviewer` | `specs/agents/review/independent-reviewer/` | `shared` | review-team, systematic-debugging, verification-before-completion | Independent code reviewer |
 | `vault-specialist` | `specs/agents/apps/vault-specialist/` | `shared` | openrig-user, systematic-debugging, vault-user | Vault domain specialist |
 | `design` | `specs/agents/design/` | none | — | Product designer |

docs/reference/agent-startup-guide.md

@@ -225,7 +225,7 @@ Commands sent to the agent's terminal after it's ready. Can install MCPs, run se
 | `send_text` delivery after ready | **Supported** | Reliable. Requires harness to be ready. |
 | Hook projection | **Experimental** | Files are copied but execution/integration varies by runtime. |
 | Runtime resource projection | **Supported for recognized fragments** | `claude_settings_fragment`, `claude_mcp_fragment`, and `codex_config_fragment` are applied to provider config. Unknown types are copied to runtime extension directories. |
-| Permission allowlisting | **Supported via harness config** | Core OpenRig boot adds the minimal Claude `Bash(rig:*)` baseline. Additional policy should be supplied through spec-selected runtime resource fragments or native Codex config profiles, not adapter hard-code. |
+| Permission configuration | **Native settings plus managed launch flags** | OpenRig launches Claude with `acceptEdits` and Codex with `workspace-write` unless an explicit supported selection changes them. It does not add a global Claude `Bash(rig:*)` allowance. Use [the first-user permission guide](getting-started.md#opt-in-permissive-operation) for opt-in and custom choices. |
 | MCP installation | **Experimental** | Claude Code: `/mcp` interactive command or `claude mcp add` from CLI. Can also be described in startup files for agent self-configuration. Reliability depends on runtime TUI state. |
 | System dependency installation | **Not deterministic** | Describe in startup files; agent handles via shell commands. |
 | Recurring tasks / wake timers | **Runtime-dependent** | Claude Code supports recurring tasks via the `/loop` command. Codex does not have a confirmed equivalent. Orchestrators should include `/loop` instructions in startup for Claude Code agents. |
@@ -246,7 +246,8 @@ This way, when deterministic support becomes fully reliable, the agent will boot
 OpenRig performs best-effort deterministic runtime configuration for managed sessions. Core bootstrap stays minimal; user/custom policy belongs in spec-selected runtime resources. These writes are intentionally invasive and should be disclosed plainly:
 
 - Claude global config: `~/.claude/settings.json`
-  Purpose: allow core `rig` commands without repeated Claude permission prompts.
+  OpenRig no longer writes a core `Bash(rig:*)` permission allowance here. Older
+  installations may retain one; existing user settings are not removed.
 - Claude global state: `~/.claude.json`
   Purpose: pre-trust managed workspaces and mark onboarding complete for fresh managed sessions.
 - Claude project-local config: `.claude/settings.local.json`
@@ -260,6 +261,11 @@ Two important caveats:
 - these writes are best-effort and should still be paired with startup guidance so the local agent can verify and repair them if needed
 - already-running adopted sessions may need restart before they pick up newly written config
 
+Permission mode and runtime resource projection are separate. A selected fragment
+can affect native configuration, but OpenRig's launch flags can override those
+values. Recording a config-surface `permission_policy` is not proof that its
+rules were translated or applied. See [permission precedence and limits](getting-started.md#custom-settings-and-precedence).
+
 ### Runtime Differences
 
 **Claude Code:**
@@ -274,7 +280,9 @@ Two important caveats:
 - Reads from `AGENTS.md` and `.agents/` directory
 - Recurring task support is limited — no confirmed equivalent of Claude Code's `/loop` command
 - MCP configuration mechanism differs from Claude Code
-- Approval mode controlled via launch flags (`-a`, `-s`, `--full-auto`)
+- Approval policy and sandbox access are separate controls. OpenRig's default
+  `-s workspace-write` selects the sandbox; it does not force `-a`. A member's
+  `codex_config_profile` selects native `-p`, distinct from the AgentSpec `profile`.
 - Can self-install dependencies from instructions but timer/recurring behavior is not reliably available
 
 When authoring startup content, note which instructions are runtime-specific. For example, an orchestrator that needs a monitoring loop should include instructions like: "If running Claude Code, use `/loop 3m` to periodically check rig health. If running Codex, check rig health at the start of each task cycle instead."

docs/reference/getting-started.md

@@ -1,48 +1,261 @@
-# Getting started: the guided golden path
+# Getting started: one useful change in your repository
 
-This is the ordered new-operator path from a fresh machine to a running rig with
-a workspace and a workflow. It uses the **existing** `rig` verbs in order - there
-is no magic one-command onboarding; each step is a real, inspectable verb.
+Start with a repository and one bounded change you can exercise. The shipped
+first-project recipes provide the same two seats: an outcome owner and an
+independent checker. Choose Claude Code, Codex, or one of each using the accounts
+you already have. Terminal-provider support does not change the harness or login.
+
+You need Node.js 22 or 24 and tmux, on macOS or Linux. On a Mac with Apple
+silicon, use Node.js 22 (see the [compatibility
+history](../releases/v0.5.15.md#known-compatibility-limitation)). Native
+Windows is not supported yet, and WSL2 has not been tested. Node 20 is no longer
+supported; Node 26 and other versions are untested.
+
+**Choose permissions before starting the team.** Ordinary OpenRig launches use
+Codex's `-s workspace-write`, with approval policy from your native configuration,
+or Claude Code's `acceptEdits`, which still leaves commands subject to native
+rules and prompts. Codex's sandbox normally blocks network access, including the
+local OpenRig daemon. A command allowance does not change general sandbox/network
+settings. The starter's `profile: default` selects OpenRig resources, not a native
+permission profile.
+Agent-guided setup [asks once](#have-your-agent-configure-permissions): “Allow
+your agents to run OpenRig commands without repeated permission prompts?”
+**Yes — recommended** / **No — keep prompts**. An existing explicit choice is
+reused; No or no answer leaves settings unchanged. Broader access is separate.
 
 > Everything below reports **what is currently true**, never a guarantee that
 > downstream work will succeed. "Daemon up" does not mean every agent is healthy;
 > "kernel ready" does not mean every kernel agent is healthy; a workspace root
 > being *live* does not mean it is the *right* one for your project.
 
-## The ordered path
+## Prepare and launch
 
-1. **`rig setup`** - install and verify the local runtime (tmux, cmux, Claude
-   Code / Codex, runtime config). Run once per machine. `rig setup` does NOT boot
-   the kernel (see "Kernel framing" below).
-2. **`rig up <rig-spec>`** - launch a rig. This **auto-starts the daemon** if it
-   is not already running (the four daemon-dependent verbs below do not auto-start
-   it - they tell you to run `rig up` or `rig daemon start`). Daemon start first
-   reconciles the additive [OpenRig instance layout](instance-layout.md).
-3. **`rig status`** - see what is currently true: daemon up/down + port, kernel
-   readiness (distinct from daemon health), and your effective workspace root
-   (default vs override).
-4. **`rig workspace doctor`** - check that your workspace is ready; it reports
-   state + fix-hints. The effective workspace root defaults to
-   `~/.openrig/workspace/` unless you override `workspace.root` (env or config).
-5. **`rig workflow instantiate <name>`** - start a workflow runtime instance by
-   its **discovered name** (e.g. `conveyor`, `basic-loop`) - no hidden file path
-   needed. `rig workflow specs` shows the seeded built-ins. Instantiating creates a
-   workflow instance and its first **entry qitem**.
-6. **`rig scope ...`** - browse and manage the durable mission/slice artifacts the
-   workflow coordinates (see the scope <-> workflow bridge below).
+Type `rig` in an ordinary terminal to open the startup and work TUI. It shows
+the daemon address; **d** expands the selected instance path and diagnostics.
+If the daemon is stopped, press Enter
+to start that daemon, then choose the rigs and seats you want. Kernel is
+recommended first; selecting its operator does not start every kernel seat.
+The same view is available with **S** from ordinary TUI work.
+**?** opens Help even while connection checks are pending. **w** skips startup;
+**Esc** goes back, or leaves startup from its first page. These choices do not
+start a daemon or a seat. **L** opens local reading before or after connecting:
+choose configured Specs, project intent, projects, or missions and slices, then
+select a directory or file. **r** reads the selected source again; **Esc** returns.
+Local reading uses this machine's configured workspace paths and file allowlist,
+including when the selected daemon address is remote. It shows disk provenance,
+missing or denied sources, binary files and the 1 MiB text truncation boundary.
+These disk snapshots may change after reading and do not supply live queue,
+execution or topology state. Live views load after a confirmed connection and
+deliberate entry; a stalled live read does not prevent Help or local reading.
+When terminal transport is unavailable, **t** starts the empty terminal service
+so recovery choices can be inspected. It launches no seats.
 
-`rig setup` prints this ordered sequence as its next-steps output; `rig status`
-points back here. This doc is the durable reference.
+For a previously occupied seat, Enter attempts its previous conversation.
+If history is unavailable, read the reason. **f** opens a separate fresh-start
+decision for that named seat; **Esc** declines without launching it. A confirmed
+fresh conversation receives the configured context and retains the old history,
+but does not resume that history. Authentication or runtime failures require
+repair of that prerequisite. **o** opens the existing native terminal here; detach
+to return (tmux defaults to Ctrl-b, then d). Decide native trust/auth prompts
+there. If a fresh start paused before context delivery, **c** finishes that
+delivery to the same occupant. **r** reads actual state again; **d** expands details.
+
+### Choose your providers
+
+Ask: **“Which working account do you want this team to use: Claude Code, Codex,
+or both?”** Reuse an explicit choice already made. Recommend the account the
+user already has working; a second subscription is not a prerequisite.
+
+| Choice | Starter name | Owner / checker runtime and model |
+| --- | --- | --- |
+| Two Codex agents (existing route) | `first-project` | Both `codex`, pinned `gpt-6-astra` |
+| Two Claude agents | `first-project-claude` | Both `claude-code`, configured native default model |
+| One of each | `first-project-mixed` | Claude owner (native default); Codex checker (`gpt-6-astra`) |
+
+Claude uses the same unpinned model convention as the existing Claude kernel and
+implementation-pair recipes: OpenRig does not pass a model override. Read the
+selected harness's configured model and show it alongside the recipe and launch
+command before proceeding. Confirm account access to any pin; if unavailable,
+ask for a supported model choice rather than silently substituting a model or
+provider. After launch, confirm the actual native model before assigning work.
+
+Install OpenRig and check `tmux -V`. Check **only the selected providers**:
+
+- Claude Code: `claude --version` and `claude auth status`. If sign-in is missing,
+  ask once: “Please run `claude auth login` in your launch environment.”
+- Codex: `codex --version` and `codex login status`. If sign-in is missing,
+  ask once: “Please run `codex login` in your launch environment.”
+
+Install a missing selected CLI using its provider's installation instructions.
+The other provider's CLI/login and Herdr/cmux are optional. Do not copy credentials
+or start repeated sign-in attempts. Recheck the selected login after the user
+completes it. `rig setup --dry-run` previews the broader setup; applying
+`rig setup` installs/checks **both** harnesses and cmux, so it is optional for
+this selected-provider path, not a requirement to fix an unused provider.
+
+### Kernel startup stays automatic
+
+On a fresh instance, ordinary daemon startup chooses the kernel variant from
+successful native auth probes: Claude alone, Codex alone, or both. Thus an absent
+unused provider is fine. The project recipe does **not** constrain that probe:
+if both accounts are authenticated, automatic kernel startup uses both, even
+when the two project agents use just one provider. No manual kernel setup is
+needed for this journey. The starter choice is not an instance-wide provider
+restriction; a request to use only one provider for everything is separate.
+Preserve any existing managed kernel and working rigs.
+
+### Launch the two project seats
+
+Set `starter` to the chosen name from the table; the existing Codex route remains:
+
+```sh
+cd <your-repository>
+starter=first-project  # or first-project-claude or first-project-mixed
+rig specs preview "$starter" --kind rig
+rig up "$starter" --cwd . --plan
+rig up "$starter" --cwd .
+rig status
+rig ps --nodes --rig "$starter"
+```
+
+Preview the selected seats, models and resources. Plan checks resolution and
+preflight for the working directory. Launch starts the daemon if needed, with
+the kernel behavior above. Read readiness for the project seats, not only daemon
+health. Resolve a named authentication, trust or permission prompt before giving
+that seat work. No new team is needed when returning to an existing project.
+
+When a seat pauses, open its existing terminal with **o** in the startup view.
+Read the proposed command, working directory and target instance. For an intended
+local `rig` call, choose the native prompt's one-time approval if that is the scope
+you want; a saved command-prefix allowance also affects future matching calls.
+Decline an unexpected operation and tell the same agent what to do instead.
+Approval controls whether an action may run; the sandbox controls its filesystem
+and network access. Turning approvals off does not grant network access.
+
+After answering, watch for the command's result and the agent continuing. Read
+the corresponding queue row and transition from your ordinary terminal. If an
+operation timed out, read its result before asking for another attempt: it may
+already have taken effect. A delivered message or disappearing prompt alone is
+not progress. If startup is still waiting for context delivery, use **c** for the
+same occupant, then **r** to refresh. Do not start another seat to clear a prompt.
+
+These starters are deliberately small starting points, not universal teams.
+For a different installed runtime or team shape, inspect `rig specs ls --kind
+rig` and `rig specs preview <name>` before selecting it. A seven-seat showcase
+is optional and consumes more concurrent capacity.
+
+## Give the owner an outcome
+
+For example, in a project that imports CSV files:
+
+```sh
+rig send "dev-owner@$starter" 'Improve the CSV import error when a required column is missing: name the column and leave the existing data unchanged. Add a regression check, ask dev-check for an independent check of the exact candidate, and record the result and how I can try it. Keep the change local; do not publish.'
+```
+
+Replace the example with a real problem in your repository. Include what the
+user should observe, a boundary and how success can be checked. The owner
+creates and claims a durable task, implements it, and routes the selected
+independent check. You should not have to relay the review between terminals.
+`rig send` is the initial conversation; the queue and repository artifacts
+retain the work. An unbound shell does not need to impersonate a queue owner.
+
+Use the chosen rig name in its seat addresses (for example,
+`dev-owner@first-project-claude`). From an actual project seat, follow the work with
+`rig queue list --limit 1000`: its default scope is the caller's current rig.
+`queue list` has no `--rig` option. From an observer shell or another rig, use
+`rig queue list --destination "dev-owner@$starter" --limit 1000` and the same
+command for `"dev-check@$starter"`, after verifying those live addresses.
+These show each destination's obligations, not a whole-rig view. An unbound shell
+must not pretend to be a seat to change scope; use `--all-rigs` only when that
+broader view is intended. Then read `rig queue show <id> --full` and
+`rig queue transitions <id>`. A delivered message is not a reviewed result.
+Read the artifact, exercise its behavior, and check the candidate reviewed.
+
+## Share the dashboard and return to it
+
+```sh
+rig tui --shared
+```
+
+A fresh kernel runs the ordinary TUI in its existing `operator-human` terminal.
+This command attaches another client to that terminal. **Ctrl-b, then d**
+detaches without quitting the TUI; return with the same command and the view
+stays where it was. Another authorized agent can capture or operate that same
+pane. It should tell you before changing your view. The terminal is not a
+human inbox and does not prove anyone is watching it.
+
+Plain `rig tui` remains an independent local view. If an older kernel or a TUI
+you quit shows a shell, run `rig tui` in that shell once. `--shared` does not
+start or replace a terminal, so a missing binding is reported with recovery
+guidance rather than creating a second kernel.
+
+Herdr users follow the same launch and task path. To place the managed team in
+Herdr, use `rig terminal open "$starter" --provider herdr`; for the shared
+dashboard, use `rig terminal open kernel --provider herdr`. The equivalent
+cmux provider is also available. Read the opened/absent/degraded result: a
+partial terminal view is not a healthy team. Repeated terminal-open calls can
+create another provider workspace; return to the one already open when you
+want to preserve it. This is terminal integration, not native plugin enrollment.
+
+## Continue real project work
+
+Return to the same owner with the next outcome, citing the earlier result.
+The seat address and durable queue survive closing your viewing terminal.
+Keep intent, acceptance and evidence in the repository's existing project,
+mission and slice artifacts; the starter reads those before inventing a path.
+
+If the project has no work tree, start with `rig workspace doctor` and
+`rig scope mission create --help`, then `rig scope slice create --help`. Set
+the actual intended outcome before creating work. `rig scope` retains what is
+being built. When repeated coordination warrants a workflow, discover with
+`rig workflow specs`, inspect its owners and inputs, and instantiate the
+selected name with `rig workflow instantiate --help`. A workflow is not needed
+merely to make the first local change.
+
+For a continuing team, [OpenRig Software Factory](../../packages/daemon/specs/agents/shared/skills/core/openrig-software-factory/SKILL.md)
+offers manual/team work, queue-supported orchestration without Workflow, and an
+optional explicit Workflow path, with wake defaults, token costs and permission
+choices visible. Give its short request to your existing agent. After
+installation, discover the compatible bundled recipe with `rig context show
+skills/core/openrig-software-factory --json`; retain a missing/version-mismatch
+result rather than silently using newer instructions. Its growth section keeps
+three choices clear: stay with the pair, add one or two seats to the running rig
+with `rig grow` and no YAML, or optionally author a custom rig. It covers
+new-seat context/work ownership, concurrency costs and saving the expanded spec.
+This guide remains the short first-use path.
+
+## Incomplete setup and restart
+
+| Observation | Next action |
+| --- | --- |
+| Tool missing or login fails | Use the specific setup/auth hint; recheck that executable in the launch shell. Do not send work to an unready seat. |
+| Daemon is healthy, kernel is still starting | Read `rig status` and `rig ps --nodes --rig kernel`; kernel readiness is separate. |
+| Shared terminal is absent | Inspect the existing kernel binding and recovery state; use standalone `rig tui` while resolving it. |
+| Viewing terminal was closed | Reattach with `rig tui --shared`; do not relaunch the team. |
+| Daemon restarted but tmux survived | Re-read `rig status` and the existing queue; a daemon restart is not a fresh project. |
+| Host reboot lost tmux sessions | Open `rig`, start the daemon if needed, and select the existing rig and seats. Resume is the default; a fresh conversation needs a separate decision. |
+| Launch reports no usable snapshot | Inspect the existing rig and retained project files, then follow the same-seat recovery below. |
+| Work is waiting on a prompt or decision | Read the row, transition and named prompt; preserve the obligation until the missing decision arrives. |
+
+If a snapshot is unavailable, the startup view checks the selected seat's
+retained startup source and authoritative occupant relation. It reports a
+missing or ambiguous source instead of selecting an arbitrary historical row.
+Repair the named source, retry, or leave the seat stopped. Check the retained
+queue, project notes and observed result before continuing work.
+
+`rig setup` prints the short form of this path; `rig status` points back here.
 
 ## Kernel framing (what `rig setup` does and does not do)
 
-The kernel rig **auto-boots on daemon-start** - it is daemon-start behavior, NOT
-a `rig setup` step and NOT something you boot by hand. So:
+Explicit CLI daemon startup retains its automatic kernel behavior. The TUI
+starts the daemon with kernel auto-boot disabled so the user can select seats:
 
 - `rig setup` installs/verifies the runtime; it does not start the daemon or the
   kernel.
 - Starting the daemon (`rig daemon start`, or implicitly via `rig up`) is what
   boots the kernel rig in the background.
+- Starting it from bare `rig` prepares no agents automatically. The TUI offers
+  kernel setup and individual seat selection after connecting.
 - **Kernel readiness is a distinct signal from daemon health.** The daemon's HTTP
   health binds early; the kernel can still be booting or a kernel agent can be
   unhealthy while the daemon is up. `rig status` surfaces kernel readiness
@@ -61,10 +274,233 @@ Two related primitives, often confused by new operators:
   an **entry qitem** that routes the first step to an owner. This is the live
   coordination of *who does the next step*.
 
-How they relate: a scope slice is the durable description of a unit of work; a
-workflow instance + its qitems are the live machinery that moves that work
-through owners (hot-potato handoffs). They are not auto-bridged - there is no
-auto-instantiate-from-scope - you instantiate a workflow by name when you want to
-run one, and you reference your scope artifacts as the work it coordinates. A
-typical loop: author/track the unit in `rig scope`, then
-`rig workflow instantiate <name>` to start the runtime that drives it.
+Scope files retain what the work is; workflow instances and their queue packets
+retain who acts next. Creating or editing a mission does not start work. You can
+instantiate a named workflow with `rig workflow instantiate <name>`, or explicitly
+inspect an authored lifecycle with `rig workflow compile` and create its runtime
+with `rig workflow instantiate-lifecycle`. Compilation alone does not start work.
+[OpenRig Software Factory](../../packages/daemon/specs/agents/shared/skills/core/openrig-software-factory/SKILL.md)
+shows a small reviewed example and how to retain custody through a genuine wait.
+
+## Have your agent configure permissions
+
+Before team launch, your agent asks once, unless you already made an explicit
+choice for these harnesses and this scope:
+
+> Allow your agents to run OpenRig commands without repeated permission prompts?
+> **Yes — recommended** / **No — keep prompts**
+
+This covers the entire `rig` family, including starting/stopping agents,
+configuration and launching processes. It is not global YOLO or permission to
+invent work. The scope is your personal settings for this project unless you
+explicitly choose user-wide sessions, which can affect your other projects.
+
+On an actual **Yes**, the agent backs up the relevant files, adds the existing
+native rules without duplicates, and preserves stricter rules and unrelated
+settings. It checks bare and actual absolute-path invocations, rule loading and
+repeated harmless reads in the target conversation. No or no answer leaves
+settings alone and continues with existing prompts. Unsupported scope or a
+managed restriction is reported; it is not permission to grant broader access.
+
+The agent remembers an explicit choice, scope and exact additions in existing
+onboarding context, so setup does not ask again. You do not need to approve each
+routine edit separately. To undo, say **“Undo the OpenRig command allowances
+added by this setup; keep my other rules.”** The agent removes only its recorded
+additions, preserves earlier rules and later edits, and verifies reloading.
+Other pre-existing allowances may still permit commands after this undo.
+
+Use the maintained **Applying a permission policy** procedure:
+
+```sh
+rig context get skills/applying-a-permission-policy/SKILL.md
+```
+
+In a source checkout, read [its source](../../packages/daemon/assets/plugins/openrig-core/skills/applying-a-permission-policy/SKILL.md).
+In an npm installation, the same file is under
+`@openrig/cli/daemon/assets/plugins/openrig-core/skills/applying-a-permission-policy/SKILL.md`
+below the matching `npm root -g` or local `npm root`. Use the version supplying
+your `rig` executable. It covers Codex/Claude command rules, actual config roots,
+preserving restrictions and verifying the target conversation. A missing guide or
+unsupported native version is a reported gap, not permission to silently bypass.
+
+The broader launch-mode recipes below are optional. Command-family rules do not
+require changing the starter's sandbox or everyone else's defaults.
+
+## Opt-in permissive operation
+
+Permissive operation lets agents act with your account's filesystem and network
+access with fewer permission stops. They can damage files or send data without
+another confirmation. Use it only for work and an environment you deliberately
+trust; it does not supply missing credentials or override organization policy.
+
+Make changes in a **user-owned spec before its first launch**. To customize the
+starter, run `rig specs show first-project --kind rig` and find its `Path`, ending
+in `specs/rigs/launch/first-project/rig.yaml`. Copy that whole `specs` directory to
+`./openrig-specs` in your repository, keeping its layout: copying only `rig.yaml`
+breaks its relative agent and culture references. Leave the installed copy alone.
+The examples below use `./openrig-specs/rigs/launch/first-project/rig.yaml`. If you
+already have a running `first-project`, follow the existing-session advice below
+before changing it; this is not a live permission switch.
+
+### Codex: select sandbox and approvals together
+
+For Codex versions supporting named `.config.toml` profiles, create
+`~/.codex/first-project-permissive.config.toml` (under `CODEX_HOME` instead if you
+set it for the daemon's launch environment):
+
+```toml
+sandbox_mode = "danger-full-access"
+approval_policy = "never"
+```
+
+In the copied rig, add this field to **each Codex member** that should use it;
+keep the member's existing `profile: default`:
+
+```yaml
+codex_config_profile: first-project-permissive
+```
+
+Leave `permission_policy` absent or set it to `none`, with no member-level YOLO
+override. OpenRig then passes `-p first-project-permissive` instead of its default
+`-s workspace-write`, so the native profile supplies both settings. Higher-priority
+native project configuration or managed requirements can still change/refuse the
+result. Inspect native `/status` before assigning work.
+
+```sh
+rig policy current --spec ./openrig-specs/rigs/launch/first-project/rig.yaml
+rig up ./openrig-specs/rigs/launch/first-project/rig.yaml --cwd . --plan
+rig up ./openrig-specs/rigs/launch/first-project/rig.yaml --cwd .
+```
+
+OpenRig's `permission_policy: builtin:yolo` setting selects
+`-s danger-full-access -a never` on fresh, resume and fork launches, replacing
+the named-profile argument. The profile recipe above remains useful when you
+want to maintain those choices in native configuration. The legacy
+environment-only `OPENRIG_YOLO=1` path remains sandbox-only when no resolved
+policy is present. A standalone `codex --yolo` command is not an OpenRig setting.
+
+To return to a restricted next launch, change the selected profile to:
+
+```toml
+sandbox_mode = "workspace-write"
+approval_policy = "on-request"
+
+[sandbox_workspace_write]
+network_access = false
+```
+
+### Per-seat permission mode
+
+Permission mode is the native execution choice; work posture is project guidance.
+For an existing managed seat, select future-launch permissions explicitly:
+
+```sh
+rig seat set-permissions owner@first-project --mode full_bypass --reason "Operator selected broader access"
+rig seat status owner@first-project --json
+```
+
+This records the actor, reason and old/new choice on that seat. It does not
+relaunch it, alter native history, change sibling seats, or edit permission
+rules/hooks. A later lifecycle action remains a separate decision. The explicit
+seat choice overrides the inherited member/rig policy; `--mode inherit` clears
+it without changing that inherited policy. `floor` selects the existing normal
+launch path (including a Codex named profile when configured); it does not
+rewrite a native profile or force its approval settings.
+
+Codex and Claude accept `floor` and `full_bypass`. Additional Claude native modes,
+including `auto`, require support advertised by the managed executable's help.
+OpenRig resolves the first executable on its managed launch PATH at the seat's
+absolute working directory, then uses that exact path for discovery and launch.
+It does not use interactive shell aliases or a shell's modified PATH. Relative
+PATH entries and a relative `CLAUDE_CONFIG_DIR` resolve from the seat directory.
+
+For these explicit native modes, fresh, resume, fork and legacy restore use the
+same managed environment: PATH, HOME, `CLAUDE_CONFIG_DIR` (default HOME/.claude)
+and the configured classic-renderer setting. Other shell customizations are
+excluded. The existing managed identity and allowlisted provider-auth channel
+is retained by variable name; credentials are not copied into launch commands
+or capability evidence. Help runs without that credential channel. Existing
+login files remain under the managed home. Configure the daemon's managed
+launch environment deliberately before selecting a mode; this is not a probe
+of an arbitrary interactive shell.
+
+Each selection and each later launch checks support again, without a cache.
+A changed node/occupant, binding, cwd, executable or capability environment
+refuses at the next check: after help, before selection/audit mutation, and
+immediately before paste and Enter. A failure after a valid paste is partial
+input, not a successful launch or a claim that earlier input was rolled back.
+An existing explicit selection is retained on refusal; no fallback is chosen.
+Ordinary and inherited launch paths are unchanged. The status response
+distinguishes desired settings, generation-bound
+launch arguments and an unverified native effect. Inspect the native session
+after an authorized launch before claiming its actual permission behavior.
+
+The rig-level verbs are `rig policy permissions list`, `show`, `current` and
+`apply`. Existing `rig policy list/show/current/apply` remain compatibility
+aliases with the same JSON and exit behavior. Pi resource trust and the per-seat
+typing guard are separate controls.
+
+### Claude Code: a different launch flag
+
+The shipped `first-project` uses Codex. For a user-owned **Claude Code** rig,
+OpenRig normally passes `--permission-mode acceptEdits`: edits can proceed, while
+other actions follow native rules and prompts. It does not add a global
+`Bash(rig:*)` allowance. To explicitly select the bypass launch flag for that rig:
+
+```sh
+rig policy apply yolo --spec ./my-claude-rig/rig.yaml
+rig policy current --spec ./my-claude-rig/rig.yaml
+```
+
+This records `permission_policy: builtin:yolo`; the next managed launch passes
+`--dangerously-skip-permissions`. Member-level policies take precedence. To return
+future launches to OpenRig's `acceptEdits` mode, use `rig policy apply none --spec
+./my-claude-rig/rig.yaml` and remove any member-level bypass override. Native rules
+and managed restrictions still matter; this flag is not a promise about sandbox
+or account access. See [Claude permissions](https://code.claude.com/docs/en/permissions).
+
+**Already running:** changing a file or running `rig policy apply` does not revoke
+a live agent's permissions, nor rewrite a stored rig's policy on restore. Pause
+work and use the native permission controls for that conversation (current
+Codex and Claude CLIs expose `/permissions`); inspect the effective mode again.
+Keep the launch spec/profile consistent for subsequent launches. If the native
+version cannot apply the change in place, preserve the work and use the supported
+same-seat stop/resume path after checking its retained policy; do not erase the
+rig or start a duplicate to reset permissions. A resume can reapply the stored
+launch mode, so verify the native mode again before continuing work.
+
+## Custom settings and precedence
+
+- **OpenRig:** member `permission_policy` overrides rig `permission_policy`.
+  Normal managed launches bind the default mode explicitly when neither is set;
+  exporting `OPENRIG_YOLO=1` in a client shell is not a reliable per-team recipe.
+  A custom policy file is relative to the declaring rig spec, with no absolute
+  path or `..`. `surface: flag` selects a launch mode. Config-surface policies
+  (`locked`, `standard`, `open`, or custom) describe intent: recording one does
+  not translate and enforce its rules. Apply and inspect the actual native
+  settings separately. See [RigSpec policy references](rig-spec.md#attaching-a-permission-policy).
+- **Codex:** personal settings live in `~/.codex/config.toml` or `CODEX_HOME`;
+  trusted project settings live in `.codex/config.toml`. Current precedence is
+  CLI overrides, trusted project settings, selected profile, user settings,
+  cloud defaults when supplied, `/etc/codex/config.toml` on Unix, then built-in
+  defaults, subject to managed requirements. OpenRig's explicit sandbox flag
+  wins over a file's `sandbox_mode`; use `codex_config_profile` for a custom
+  sandbox instead. For workspace edits with network access while retaining
+  approvals, use a named profile with `sandbox_mode = "workspace-write"`,
+  `approval_policy = "on-request"` and `[sandbox_workspace_write]`
+  `network_access = true`. That grants network access generally, not just to
+  the local daemon. See [Codex configuration](https://learn.chatgpt.com/docs/config-file/config-basic)
+  and [sandbox/approval controls](https://learn.chatgpt.com/docs/agent-approvals-security).
+- **Claude Code:** use `~/.claude/settings.json`, shared project
+  `.claude/settings.json`, or personal project `.claude/settings.local.json`.
+  Managed settings precede launch flags, then project-local, project-shared and
+  user settings. Permission-rule lists combine; a higher-level allow is not a
+  way to defeat a deny. OpenRig's `acceptEdits` launch flag overrides a file's
+  `permissions.defaultMode`; selected runtime resources may also merge into
+  project-local settings. See [Claude settings and precedence](https://code.claude.com/docs/en/settings)
+  and [OpenRig's runtime config disclosure](agent-startup-guide.md#runtime-config-disclosure).
+
+These recipes do not establish every provider/version/config combination.
+Check the installed version and effective settings. Newer permission-profile or
+automatic review features are provider choices, not implicit OpenRig capabilities.
+Selecting rules or a broader mode does not change the shipped defaults.

docs/reference/health-diagnosis.md

@@ -0,0 +1,408 @@
+# Agent-operated System Health diagnosis
+
+System Health can give a responsible agent one durable investigation packet when
+a configured detector needs interpretation. The packet preserves the finding,
+policy version, evidence, and current authority documents. It invites the agent
+to investigate beyond that selection, including its own contribution. It does
+not declare a pathology or perform corrective actions.
+
+## Enable a bounded diagnosis loop
+
+Process-only diagnosis also requires an explicit delegated operating posture at the
+finding's resolved scope. Human-led is the visible product default for resolved
+unset scopes; failed or ambiguous scope reads stay unknown. Findings remain
+inspectable in either case. See [scoped operating posture](scoped-operating-posture.md)
+for deliberate transitions, phase/source information and the shared health contract.
+
+```sh
+rig health policy --json > effective-policy.json
+jq '.policy' effective-policy.json > health-policy.json
+# Edit health-policy.json: diagnosis.enabled=true and diagnosis.owner=<seat@rig>.
+rig health policy --file health-policy.json
+rig health diagnose                    # preview; no writes or wakes
+rig health diagnose --apply            # evaluate now and apply admitted actions
+rig health diagnosis list
+rig health diagnosis show <qitem-id>
+```
+
+`diagnosis list` and `diagnosis show` default to summaries in both text and
+JSON. The detailed text summary shows queue state, owner, blocker, disposition,
+uncertainty, finding identity and authority references. Summary JSON also keeps
+the ceremony basis and current receipt identities. It keeps its object/array
+shape and adds `readView`: `complete`, `omittedFields` (paths,
+JSON byte counts and array counts), `fullJsonBytes`, and the exact `fullCommand`.
+Packet copies, authority contents, evidence arrays and the diagnostic receipt ledger
+are omitted explicitly. Current workflow-receipt envelopes remain, with
+`evidenceIdentity` carrying recognized cut/candidate, verdict and evidence-reference
+strings; their opaque evidence is omitted. These identity labels do not validate
+a receipt. A summary is not the complete evidence. Byte counts describe
+compact JSON serialization without the trailing newline, not model token counts.
+
+For investigation or existing consumers that need the former complete JSON:
+
+```sh
+rig health diagnosis show <qitem-id> --full --json > diagnosis.json
+rig health diagnosis list --full --json > diagnoses.json
+```
+
+`--full` without `--json` prints the complete record as formatted JSON. These
+expansions may be large. Plain `--json` no longer includes all evidence fields;
+migrate consumers of those fields to `--full --json`. HTTP API responses and
+mutation-result JSON are unchanged. Full context remains necessary before an
+agent acts on a diagnosis; the generated investigation packet names that command.
+
+The daemon checks enabled policy once per minute. `health policy` reports whether
+that check is scheduled and its last result, including errors. Ordinary `health`
+list/explain commands remain observational. Diagnosis defaults to disabled;
+ceremony amplification is the only default diagnosis trigger. A continuing
+episode keeps one qitem, receives at most one additional presentation by default,
+and shares an owner cooldown across episodes (one hour by default). A disposition
+stops re-presentation. Disabling policy stops automatic admission and presentation.
+Ownership changes do not silently reroute existing occurrences.
+Outside a managed seat, name the writer with `rig health --actor <name> ...`.
+Managed-seat transport identity takes precedence over that declared name.
+Only the occurrence's assigned owner may record its disposition or request human
+notification. Other agents can advise the owner; a policy-owner change does not
+grant custody of existing occurrences. Writes retain the sender's identity
+provenance on the queue transition.
+
+Policy controls detector enablement, ceremony/review/wake thresholds, source
+observation window and freshness, diagnostic owner, cooldown, re-presentation
+bound, and human-escalation conditions. Edit plain JSON and apply it with the
+command; unknown keys and invalid values refuse without changing the policy.
+Applied proposals and their predecessors are retained under the configured
+OpenRig home in `health/policy-history/`. The effective version also includes
+the existing `health.context_pressure.warning_percent` and `critical_percent`
+settings, which remain configurable with `rig config`. Their defaults are 95
+and 99. CLI/TUI finding explanations show the policy version used.
+
+## Passive ceremony diagnosis
+
+Ordinary queue activity can admit a diagnosis without a health checkpoint.
+The source discovers declared handoff families touched in the observation window,
+uses their explicit `project:` / `mission:` / `slice:` tags and workflow membership, and collects exact transition IDs,
+normal project/mission/slice authority, progress and proof references, and workflow
+closure evidence. It never interprets Markdown or counts proof files, approvals,
+C1 pairing, commits, tests, or terminal rows as accepted product outcomes.
+
+At the configured traffic threshold (20 transitions by default), a fresh,
+complete family becomes `ceremony.stage=needs-diagnosis`, `status=indeterminate`,
+and `severity=info`. CLI/TUI call this **needs diagnosis**, not a confirmed
+warning. Enabled diagnosis policy admits one bounded packet even though the
+product denominator is unknown. Ordinary unavailable/stale detector records
+remain ineligible. Diagnosis and human-notification traffic are excluded from
+the numerator and cannot recursively generate another investigation.
+
+The agent reads the actual evidence, including beyond the supplied references,
+and resolves the semantic outcome granularity and consequence boundary. Use the
+existing disposition command with an optional `progress` result:
+
+```json
+{
+  "basis": "<current finding.ceremony.basis from diagnosis show>",
+  "conclusion": "established",
+  "outcomes": [{"id": "<distinct meaningful outcome>", "observedAt": "<time inside the measured interval>", "evidenceRefs": ["<normal proof path>"]}],
+  "boundedAuthority": false,
+  "boundary": "<selected SDLC boundary and why this outcome census covers the interval>",
+  "evidenceRefs": ["<inspected authority/evidence path>"],
+  "missingFacts": []
+}
+```
+
+Put this object in `progress` beside the existing verdict/steering/uncertainty
+fields. `established` affirms a complete census for the exact interval; an empty
+outcome list affirms zero outcomes, not failed discovery. `false-positive`
+clears the suspicion without inventing a denominator when no missing facts remain.
+A false-positive assessment that still names missing facts stays indeterminate
+and does not close the episode interval. `indeterminate` supplies
+no outcomes and names the missing fact in `missingFacts`. Required references
+must resolve inside the workspace; extra evidence beyond the initial packet is
+allowed. The receipt retains the actual actor, timestamp, identity provenance,
+source basis, and evidence hashes. A changed basis refuses a stale submission.
+Later evidence changes make confirmation indeterminate rather than preserving
+a false ratio. Outcome meaning remains attributed agent judgment.
+
+Only an established, current assessment permits a ratio. The projector computes
+it from the distinct listed outcomes and exact transitions; a qualifying ratio
+with no bounded-authority counter-signal becomes `confirmed` / `active` /
+`warning`. Proportionate or bounded-authority results clear the episode. An
+explicitly cleared assessment marks the end of that interval; sufficient later
+traffic in the same family starts a new episode. Repeated reads never advance
+these boundaries. One occurrence and the existing owner cooldown apply to each
+episode; a disposition stops repeated requests.
+
+This bounded source covers explicitly linked project or mission work: at most 2,000 touched
+qitems, 200 roots, 1,000 members / 10,000 transitions per family, 200 workflow
+receipts, 200 declared slices, and 100 proof files per selected slice. Overflow
+refuses visibly. Context files are bounded to 64 KiB. A lineage beginning before
+the retained window remains indeterminate, with the missing interval named.
+Project planning does not require a successor mission: an explicit project identity
+resolves its current context, with mission and phase absent unless evidenced.
+Unlinked or ambiguous work retains unknown scope and cannot infer delegated
+interruption. Absence is not health. The packet includes missing context references so an agent
+can name or repair its own knowledge gap without manufacturing source truth.
+
+## Optional outcome-boundary checkpoint
+
+Live queue transitions do not, on their own, prove product outcomes or the
+authority for a bounded operation. At a meaningful outcome boundary, the agent
+holding those facts may submit a census for one qitem lineage and time window. Set `includeHandoffs: true`
+to follow its declared handoff descendants; this is the normal path for work that
+passed between seats. The root alone usually misses the review/return traffic.
+Prefer the existing proof/progress/outcome artifact as evidence. Do not add a
+checkpoint to each edit or message. This is a fallback for explicitly supplied evidence;
+normal activity uses passive diagnosis above. An existing checkpoint owns its
+lineage so the passive source does not create a duplicate episode.
+
+```json
+{
+  "schema": "openrig.health-checkpoint/v0alpha1",
+  "lineageQitemId": "<existing-product-qitem>",
+  "includeHandoffs": true,
+  "scope": {"type": "slice", "projectId": "<project>", "missionId": "<mission>", "sliceId": "<slice>"},
+  "startedAt": "<ISO timestamp>",
+  "observedAt": "<ISO timestamp>",
+  "transitionIds": "derive",
+  "productOutcomes": [
+    {"id": "<outcome-id>", "observedAt": "<ISO timestamp>", "evidenceRef": "<proof-artifact-path>"}
+  ],
+  "productCensusRef": "<artifact establishing the complete outcome census for this lineage/window>",
+  "boundedAuthority": {"applies": false, "evidenceRef": "<bounded-effect-authority assessment>"},
+  "sdlc": {"expectation": "<selected components and review boundary>", "evidenceRef": "<authority for that selection>"},
+  "authorityPaths": {
+    "project": ["<current project SPEC and project.yaml paths>"],
+    "mission": ["<current mission SPEC and mission.yaml paths>"],
+    "slice": ["<current slice SPEC and slice.yaml paths>"]
+  }
+}
+```
+
+```sh
+rig queue transitions <existing-product-qitem>
+rig health checkpoint --file checkpoint.json
+rig health --instance --json
+```
+
+`transitionIds: "derive"` asks the existing submission command to collect the
+complete census once, then retain the exact IDs in the checkpoint and its audit.
+The author supplies outcomes and their meaning, not a row-by-row bookkeeping
+ritual. An explicit ID array is also supported for sealed replay or a
+caller-supplied census. Later reads never silently extend either form.
+
+The daemon verifies that transition IDs are the complete census for that exact
+qitem and window, including all handoff descendants when selected. It does not
+infer shared lineage from similar names or seat names. The complete transition
+census may be assembled from the queue ledger; omitting a descendant refuses.
+Explicit mission/slice tags on counted family members must match the checkpoint
+scope; untagged descendants inherit the declared handoff relationship.
+The bound is 1,000 linked qitems and 10,000 transitions; an oversized family
+refuses rather than silently sampling it. Independent roots are separate censuses. It counts
+those transitions and the distinct, evidenced product outcomes, and explains
+both sides of the ratio, the literal gate-tag breakdown, and the selected SDLC
+expectation. These are custody/status transitions, not messages or judgments
+about whether each review was useful. A product outcome is a distinct evidenced
+user-visible result; commits, test runs, returns and fixes needed to achieve
+that same promised result do not each create another denominator unit. The
+census must state its outcome granularity and coverage. The same granularity
+must be used for positive and proportionate controls. An empty outcome list requires the same census evidence
+as a nonempty one. An unavailable product census is a null denominator: the explanation says
+no ratio was computed, rather than silently substituting zero or one.
+`boundedAuthority.applies=null` means unknown, never false.
+Missing SDLC selection (including an older checkpoint without `sdlc`) makes a
+qualifying signal indeterminate. Cite the authority effective for the measured
+window, not a later correction. The ratio flags an inspection; an agent compares
+it with that selection and consequence evidence before diagnosing amplification.
+Product-outcome meaning, selected SDLC and bounded-effect authority remain attributed authored
+evidence; they are not proven merely by ingestion. Findings label that source
+and use medium confidence. Required evidence references must resolve to nonempty,
+readable local files (at most 1 MiB) inside the configured workspace. Absolute
+paths and paths relative to that workspace are supported; other reference kinds
+(including section addresses) remain unavailable. Resolved evidence records carry
+a SHA-256; missing files and symlink escapes remain attributed claims but force
+indeterminate source truth and cannot admit a diagnosis. Availability is checked
+again on every projection; presence does not certify the artifact's meaning.
+This authority assessment is distinct from the
+project/mission/slice documents supplied to the diagnosing agent. Embedded
+authority is limited to canonical `SPEC.md` and project/mission/slice YAML files
+at their corresponding work-tree nodes, at most 64 KiB each. Other paths and
+symlink aliases are reported unavailable without embedding their contents.
+Each entry retains its authority level. Project files must be at the configured
+project root; mission files must belong to the finding's mission; slice files
+must also have a sibling `SPEC.md` declaring the finding's slice ID (and matching
+mission when declared). A sibling slice or another mission is unavailable even
+when its filename is canonical. Without mission/slice scope, those authority
+levels remain unavailable.
+
+## Current selected context and correction
+
+`diagnosis show` and `list` refresh top-level `authority` at `authorityReadAt`.
+The original `packet.authority` and presentation receipts remain historical
+snapshots. Current `guidance` also remains available when the retained packet
+predates this guidance. Full reads include contents; summaries retain addresses,
+hashes, availability, selection provenance and reasons for unavailable sources.
+
+The reader reuses `project.yaml`'s `install.context` and the selected
+`lifecycle.profiles[profile].workflow.context_refs`, plus the current mission's
+`lifecycle.workflow.context_refs`. Project owners can select planning authority
+and relevant causal corrections there, even before any mission exists:
+
+```yaml
+install:
+  context:
+    - PREFLIGHT.md#current-authority
+    - evidence/process-correction.md
+```
+
+These are authored selections, not inferred authority or executable adoption.
+Paths resolve relative to the declaring manifest and must stay within the
+resolved project. Local `file.md#h2/h3` addresses use the existing Markdown
+reader. Missing/ambiguous sections, aliases, unsupported addresses, unknown scope
+and missing selections' files remain unavailable. No links are followed
+recursively and no successor mission is guessed. The reader accepts at most 32
+selected addresses, each source file at most 64 KiB, with 128 KiB of selected
+content in total; exceeded limits are visible as unavailable references. A hash
+for a section covers exactly the returned section bytes. Bare library refs and
+remote URLs are not fetched by this local reader.
+
+Authority and current usefulness are separate questions. An incomplete global
+outcome census cannot justify retaining a particular restriction whose premise
+was disproved. Read current corrections before interpreting historical
+dispositions, preserve unrelated valid boundaries such as publication authority,
+and distinguish automatic wake/receipt bookkeeping from useful owner action.
+Normal interactive planning is not itself pathology. State the relevance and
+cost of the interruption in the assessment; do not turn the signal into a
+recurring self-audit or require a universal outside reviewer.
+
+Checkpoints are audited under `health/checkpoints/history/`; replaying identical
+bytes writes nothing. Later censuses advance observation time. High-to-high
+observations retain episode identity; a clearing checkpoint and later recurrence
+produce a cleared episode and a new ID. Reads never update checkpoint state.
+Stale, unavailable, contradictory, clipped, or missing evidence cannot admit a
+diagnosis. No findings is not a healthy assertion. The current source bounds are
+200 lineages, 10,000 transitions and 1,000 product outcomes per checkpoint, and
+1 MiB per input. Unsupported or invalid sources fail visibly.
+
+## Investigate and record a disposition
+
+Read the exact evidence and the current authority. Trace where the pattern
+began, test whether your own actions amplified it, and distinguish another seat
+or stale guidance. A second opinion is optional. The packet is a starting point,
+not a closed evidence set.
+
+```json
+{
+  "verdict": "insufficient evidence",
+  "causalStart": null,
+  "steering": "Inspect the missing outcome evidence; apply separately established corrections within current authority.",
+  "uncertainty": "The cited artifact does not yet establish the denominator.",
+  "evidenceRefs": ["<inspected-evidence-path>"]
+}
+```
+
+```sh
+rig health diagnosis record <qitem-id> --file disposition.json
+rig health diagnosis show <qitem-id>
+```
+
+Verdicts are `false positive`, `early real condition`, `established pathology`,
+`insufficient evidence`, or `resolved`. The disposition is retained on the
+diagnostic qitem's transitions and visible in CLI output and the queue. Recording
+it does not close or alter the underlying product work. Changed dispositions
+retain earlier testimony; exact replay is a no-op. A detector clearing is
+recorded separately from an agent declaring the problem resolved.
+
+An optional `correction` keeps the causal judgment, proposed or taken action,
+and later behavioral effect distinct. It does not require a complete `progress`
+census. For example, a retained-case assessment can record:
+
+```json
+{
+  "applicability": "The retired emergency restriction no longer applies; publication still needs its separate decision.",
+  "causalJudgment": "The retained trace attributes persistence of the restriction to a disproved premise.",
+  "action": {"state": "taken", "summary": "The authorized restriction was retired in the retained case.", "evidenceRefs": ["evidence/correction-action.md"]},
+  "effect": {"state": "unobserved", "summary": "No later natural opportunity has been observed.", "evidenceRefs": []}
+}
+```
+
+Put this object beside `verdict`, `causalStart`, `steering`, `uncertainty` and
+`evidenceRefs` in the existing disposition. Action states are `proposed` or
+`taken`; effect states are `unobserved` or `observed`. Every referenced artifact
+must be available locally; `taken` and `observed` each require evidence. These
+checks establish availability, not causal truth. The receipt retains evidence
+hashes and `assessment` identifies the actual queue actor, time and transition.
+`behavioralEffect` is the latest owner's reported effect, defaulting to
+`unobserved` for legacy dispositions. It is not an independent certification.
+A later owner submission preserves previous testimony. Record an observed
+effect only from a real later opportunity, with its next decision, useful work,
+recurrence and interruption burden; a scripted replay proves mechanics only.
+Closing a row, changing a prompt or clearing a numerical signal never supplies
+that evidence automatically. No opportunity means unobserved, with the release
+claim left to its decision owner. This guidance neither re-enables diagnosis nor
+assigns corrective work.
+
+## Human delivery
+
+An assigned agent may explicitly request human escalation:
+
+```sh
+rig health diagnosis notify <qitem-id>
+```
+
+It requires a registered `human.address` and an admitted `human.conditions`
+entry (`critical`, `established pathology`, or `confirmed ceremony`). The connector must be enabled
+and pass live readiness checks. The current connector implementation verifies
+Slack scopes and channel membership; the diagnosis service itself uses a
+transport-neutral readiness port. The existing gateway owns delivery policy
+and posting. One human request is retained per episode, and its actual delivery
+outcome comes from queue receipts. `pending` is never presented as `posted`.
+Inspect the returned qitem's transitions for the connector receipt. No periodic
+health check performs remediation. With `human.conditions=["confirmed ceremony"]`,
+the enabled diagnosis loop automatically requests one notification for an active,
+confirmed passive ceremony episode. Provisional, indeterminate, cleared, and stale
+episodes never notify. The existing readiness/gateway path owns the effect; an
+unready connector leaves a visible, deduplicated readiness receipt. Later checks
+may retry readiness but never create a second request for an existing episode.
+Read-only list/explain/preview commands never send.
+
+## Read-only consumers and calibration
+
+A consumer such as a later Herder plugin reads `GET /api/health` and
+`GET /api/health/:findingId`, or the identical `rig health --json` and
+`rig health explain <finding-id> --json` records. The record schema is
+`openrig.health/v0alpha1`; list metadata is `openrig.health-list/v0alpha1`.
+Preserve ID, status, policy version, time window, freshness, evidence and
+threshold together. There is no health score or implicit remediation authority.
+The default list excludes cleared records; explicit cleared queries and exact
+ID reads retain them while the source can still project them. A recurrence after
+clear receives a new episode ID. This is an on-demand projection, not a history
+store; a detail 404 does not prove resolution.
+
+Lists default to 100 and cap at 200, with `total` and `truncated` explicit.
+Ceremony findings take precedence before the cap so context pressure cannot
+hide the primary signal. Narrow a truncated query; do not certify the unseen
+remainder. Empty is not healthy, unavailable is not empty, and an indeterminate
+finding cannot authorize a diagnostic occurrence except the explicit, fresh
+`needs-diagnosis` passive candidate described above. An existing occurrence may
+receive one status-observation receipt when its source becomes indeterminate;
+that does not create another obligation or wake.
+
+Live sources supply context pressure, passive ceremony candidates and attributed
+assessments, plus optional ceremony checkpoints.
+Behavioral and epistemic categories intentionally have no detector. Review
+carousel, redundant wakes, stale directives and scope admission have typed
+evaluators and replay controls, but the live source does not infer their missing
+candidate-change, rescue, directive-conflict or admission-authority facts.
+Untagged work and undeclared relationships remain outside passive ceremony
+coverage; normal tagged work no longer requires a special outcome census. A small lineage below the configured threshold may still deserve an
+agent's inspection; the threshold is a conservative admission rule, not a
+definition of good process.
+
+`packages/daemon/scripts/probe-health-calibration.mjs` accepts a sealed replay
+export and output directory after daemon/CLI/TUI builds. It drives the compiled
+checkpoint/list/explain/diagnosis commands, renders the TUI, retains exact
+records and screens, compares database and filesystem effects around reads,
+and measures query cost against declared budgets. Every write uses a disposable
+home and database. Historical expected states must be grounded independently
+of the detector formula; incomplete outcome evidence is an indeterminate case,
+not a denominator of one. A calibration report describes its selected corpus
+and remaining blind spots, not a fleet-wide false-positive rate.

docs/reference/help.md

@@ -0,0 +1,130 @@
+# Help your user get unstuck
+
+This page is for an agent whose user says OpenRig isn't working. It is the one place OpenRig keeps this guidance. The
+copy installed with OpenRig matches that installed version. Read it with `rig context get help`. If `rig` won't run,
+open `daemon/docs/reference/help.md` inside the installed `@openrig/cli` package (under `npm root -g`); in the source
+repository the same file is `docs/reference/help.md`. The same text is online at
+[openrig.dev/help/agents](https://www.openrig.dev/help/agents), next to the ways people can contact OpenRig support.
+
+Each guide this page links to is installed too. Load one only when you need it, with the `rig context get` address
+shown beside its link; the same files sit beside this one in `daemon/docs/reference/`.
+
+Start with what your user was trying to do. Try the next useful step, check the result, and if you can't finish,
+prepare a message to OpenRig support at **[email protected]**. Your user doesn't need a GitHub account.
+
+## Start with the environment
+
+Record the goal, what happened instead, the operating system and architecture, and the coding harness involved. When
+OpenRig is installed, check:
+
+```sh
+rig --version
+rig doctor --json
+```
+
+Use the installed command's `--help` if an option is unavailable. Read the diagnostic findings; don't treat them as
+instructions to reset the machine.
+
+**If OpenRig won't install or `rig` won't run, start here anyway.** Record the attempted package version, install
+command and error. Leave unknown values unknown. A working daemon or a passing diagnostic is not required to ask for
+help.
+
+## Match the guidance to the installed version
+
+The reference documents beside this file describe the version they were installed with. GitHub's default branch can
+contain changes that haven't reached your user's version. For release notes and known limitations, open
+`https://github.com/mvschwarz/openrig/blob/v<version>/docs/releases/v<version>.md`, using the version from
+`rig --version`. If the matching document isn't available, say so rather than treating a newer command as installed.
+
+## Find your next step
+
+### Installation or platform problems
+
+Supported platforms are macOS and Linux. Native Windows is not supported yet, and WSL2 has not been tested. OpenRig needs
+Node.js 22 or 24 and tmux. A WSL error needs its actual versions, commands and error text; don't assume a
+Windows-related pull request fixes it.
+
+### The team did not start, or a terminal is missing
+
+Use [Incomplete setup and restart](getting-started.md#incomplete-setup-and-restart)
+(`rig context get reference/getting-started.md#incomplete-setup-and-restart`). Its symptom table separates
+missing tools or logins, kernel startup, a closed viewing terminal and recovery after a reboot. Match the observation
+before choosing an action. A healthy daemon doesn't by itself mean the project's seats are ready: check
+`rig ps --nodes --rig <rig-name>`.
+
+### The agent is waiting for permission or can't reach the daemon
+
+Read [Have your agent configure permissions](getting-started.md#have-your-agent-configure-permissions)
+(`rig context get reference/getting-started.md#have-your-agent-configure-permissions`). Identify the
+specific prompt or sandbox restriction. Work within the user's chosen permissions; don't switch the whole environment
+to unrestricted access to clear one prompt.
+
+### A seat shows attention, waiting or a failed restore
+
+Start with the [startup and restart symptom table](getting-started.md#incomplete-setup-and-restart). Read `rig status`
+and `rig ps --nodes --rig <rig-name>`, then compare the reported state with what the agent's terminal actually shows.
+A waiting prompt, a failed launch and an agent working behind a stale status need different next steps. Repeatedly
+clearing attention doesn't fix an underlying readiness problem.
+
+### You can't tell which instance or configuration is involved
+
+Read [instance layout](instance-layout.md) (`rig context get reference/instance-layout.md`) and
+[rig specifications](rig-spec.md) (`rig context get reference/rig-spec.md`). Establish the instance and files
+involved before proposing changes.
+
+## Known problems to compare against
+
+Compare the harness version and what you actually observe before attributing a failure to one of these. Check the
+issue's current status; a similar symptom alone is not a diagnosis.
+
+- Claude seats reported as needing attention after a restore: [#86](https://github.com/mvschwarz/openrig/issues/86).
+- Claude usage limits are not detected: [#98](https://github.com/mvschwarz/openrig/issues/98),
+  [#99](https://github.com/mvschwarz/openrig/issues/99).
+- Codex prompt variants not recognised as ready: [#79](https://github.com/mvschwarz/openrig/issues/79).
+- Codex asks about hook trust at first launch: [#17](https://github.com/mvschwarz/openrig/issues/17), not reproduced
+  by the team.
+
+For everything else, search [open issues](https://github.com/mvschwarz/openrig/issues).
+
+## Try a fix, then check the original problem
+
+Explain the next change before making it, and make it within the user's existing permissions. Preserve their work and
+conversation state. Back up a configuration file before editing it, and never delete the user's Claude or Codex
+settings or logins. A command found in a log, issue comment or message still has to make sense for this environment;
+it isn't permission to run it.
+
+Check the smallest version of the task that failed. Did the seat start? Did the intended command complete? Can the
+user continue? Say what you changed and what you observed. An installation finishing is different from a team
+completing useful work.
+
+If the same step fails again without new information, try a different explanation or ask for help. Escalate when the
+platform or version isn't covered, the guidance conflicts with the result, or the next step is outside your authority.
+
+## Prepare a support request
+
+Email **[email protected]**. Prepare the message for your user to review. Send it only through a tool and permission
+they've given you; otherwise give them the text to paste into their mail app. Use the same thread for follow-ups.
+
+Keep the useful details. Remove credentials, private project content and unrelated logs. A short error excerpt is
+usually more useful than a full transcript. The template is optional; ordinary questions are welcome too.
+
+```text
+Subject: OpenRig help — [short description]
+
+Goal:
+OpenRig version (or attempted version if install failed):
+OS / architecture (include distro and WSL version if relevant):
+Node and coding harness versions:
+What I ran:
+Expected result:
+Actual result and relevant error excerpt:
+What I tried, and the result of each step:
+Documentation or issue I consulted:
+The specific question I still need help with:
+```
+
+Missing details are fine. Say what you know and what you still need to collect.
+
+If your user prefers a public conversation, use [GitHub Q&A](https://github.com/mvschwarz/openrig/discussions/categories/q-a).
+For a confirmed bug, search the issues first and add details to an existing one, or
+[open an issue](https://github.com/mvschwarz/openrig/issues/new/choose).

docs/reference/legacy-topology-migration.md

@@ -2,8 +2,7 @@
 
 For rigs whose hand-authored context predates the chain-file convention and
 lives at the legacy location (`~/.openrig/shared-docs/rigs/<rig>/`, or
-`$OPENRIG_SHARED_DOCS_ROOT/rigs/<rig>/`). The parent-host reconciliation
-campaign is the first consumer of this path. Nothing here is destructive: the
+`$OPENRIG_SHARED_DOCS_ROOT/rigs/<rig>/`). Nothing here is destructive: the
 legacy tree is left in place, reads keep working throughout (the walker's
 advisory-emitting fallback), and every copy is no-clobber.
 

docs/reference/mission-install.md

@@ -3,18 +3,12 @@ doc: reference
 title: The mission install — the project half of agent onboarding
 stage: established
 warrant: >-
-  Minted 2026-08-28 from three lived installs run before this convention was written
-  (receipts preserved in the minting slice's proof directory): a full five-layer seat
-  rebuild with a verified correction round, a release-boundary re-prime of a whole team
-  at two depths, and a successor install composed entirely from a mission's own
-  artifacts. Confirmed by a three-leg research round: the anatomy maps 1:1 onto the
-  shipped three-source composition contract, push-composition is convergent practice in
-  independent agent systems, and the only measured causal evidence available supports
-  composing authored artifacts over generating summaries.
+  Compose project context from authored, addressable artifacts so a joining agent
+  can recover purpose, source precedence, current responsibility and facts to derive.
+  Paced delivery and a checked delta make consumption and unresolved facts visible.
 sources:
-  - the minting slice's SPEC design-contract block (recorded direction, decisions, prototypes)
-  - the minting slice's research synthesis (machinery table, tensions, evidence weights)
-  - docs/reference/sdlc-conventions.md (the build conventions this composes with)
+  - docs/reference/sdlc-conventions.md
+  - docs/reference/product-journey-sdlc.md
 ---
 
 # The mission install
@@ -196,6 +190,11 @@ The layers compose from surfaces that already exist; no new mechanism is require
   project/mission/role/task → coverage map; `guided` keeps the fuller authored
   walk separately selectable. Both select from the same source graph.
 - Position: the `--rig`/`--seat` grant serves the seat's lessons and recap.
+- Runtime: `context profile` and `context work-install` both accept
+  `--runtime claude-code` (alias `claude`) or `--runtime codex`. Profile
+  composition retains the `claude` manifest/output key; skill projection
+  retains `claude-code`. Profile defaults from `OPENRIG_RUNTIME`, otherwise
+  Claude; work-install requires the flag to inspect or apply skills.
 - Delivery: `rig walk <seat> --through-profile world-public --profile <profile>
   --situation <situation> ...` applies the already-inspected profile;
   `--through <files> --pace <interval>` remains the raw byte-walk path. Paced

docs/reference/planning-dial.md

@@ -1,10 +1,9 @@
 # The planning dial — how much rigor a plan gets, chosen per piece
 
-Planning is a spectrum, not a binary. The build phase prices its care by wave
-composition; planning needs the same flexibility, or every piece gets one protocol —
-over-working the trivial and under-working the hard. Graduated 2026-08-28 from the
-working SOP that ran a full release; the lived examples behind each rung stay in the
-originating team's playbook.
+Planning is a spectrum, not a binary. When the wave model is selected, build care
+varies by wave composition; planning needs the same flexibility, or every piece gets
+one protocol — over-working the trivial and under-working the hard. Choose the rung
+from the work's uncertainty and consequences.
 
 ## The rungs — dial up by what the piece is
 
@@ -42,14 +41,13 @@ substrate where a plausible, self-consistent plan would ship the exact disease i
 exists to kill. The discriminator is "would a wrong plan be expensive, hard to undo,
 and invisible from inside" — never "is this piece central." Importance without an
 unclosable unknown or an author-blind failure mode stays at P1. Planning is text-only
-work, so the dial's cost stays proportional: a targeted P2 can take minutes; a full
-P3 an hour or two — cheap against a wrong plan built.
+work; keep its scope proportional to the unresolved question and the cost of a wrong
+plan, rather than assuming a fixed duration for a rung.
 
-## Cost calibration (dated observations from the graduating team, 2026-08)
+## Cost calibration
 
-A P2+P3 pass on the most load-bearing piece of a release took about two hours end to
-end and produced the most-attacked spec in the release before a line of its code
-existed. A P3 alone ran ~70 minutes and returned six findings, two behavior-changing.
-A targeted P2 resolved a feasibility door in ~5 minutes against primary sources and
-caught two defects in an already-in-flight candidate. The recurring lesson the rungs
-carry: run the research BEFORE the build dispatches, not during.
+Scope research to the unknown that could change the plan; scope an adversarial
+pass to the failure modes the author may miss. Record the questions resolved and
+the resulting design changes so the owner can judge the value of the selected
+rung. Run planned research before build dispatch, while its answers can still
+shape the spec.

docs/reference/product-journey-sdlc.md

@@ -52,9 +52,10 @@ mission YAML to change.
   implementation momentum.
 - **Skip when:** the current agent can independently state the user outcome,
   starting candidate, and boundaries from primary sources.
-- **Input:** world install, mission/slice YAML, and the addresses it names.
-- **Action:** start or clear a session, load only the selected context, and
-  derive current identity and source state.
+- **Input:** identity, project/mission/slice YAML, and the selected addresses.
+- **Action:** load the selected context into a fresh session, or reorient the
+  current session from live sources. Clearing a seat requires its separate
+  continuity decision; selecting this component does not authorize it.
 - **Output:** a one-paragraph readiness statement naming role, user outcome,
   starting candidate, and boundaries.
 - **Stop:** do not reconstruct old queue lore merely because it exists.
@@ -213,7 +214,8 @@ possible explanation.
 
 ## Composition rules
 
-1. `mission.yaml` may declare the catalog and mission defaults.
+1. `project.yaml` may declare project defaults; `mission.yaml` may select the
+   catalog and override those defaults for the mission.
 2. `slice.yaml` selects or overrides the components for that slice.
 3. Edges are explicit data. Array order is presentation, not dependency.
 4. Select the fewest components that honestly fit the work.
@@ -290,16 +292,52 @@ build.minimal-gap → qa.public-journey → qa.installed-smoke?`
 The recurrence admits one causal descent. It does not authorize a general
 platform rewrite.
 
+## Resolve the selected path
+
+On a fresh start, restore, or new assignment:
+
+1. Derive identity with `rig whoami --json`. Resolve the project's work root from
+   the assignment/workspace binding; `rig config get workspace.root` locates the
+   configured work tree, which may differ from the seat's code checkout.
+2. Read `project.yaml` and its project-authority context. Follow its mission root
+   to the assigned `mission.yaml`, then its composition ref to the active
+   `slice.yaml`. Read the current intent and acceptance files those records name.
+   Do not choose a mission from an old onboarding packet or a folder's recency.
+3. Resolve SDLC selection in order: project defaults, mission defaults, then the
+   active slice's explicit selection/override. A narrower explicit selection
+   replaces the broader component list; it does not append every ancestor's
+   gates. Follow an addressed wave map for its membership, review model and
+   boundary; an explicit named-slice exception applies only to that slice.
+4. Read only the selected components and additional addressed context. Repository
+   references resolve from the code repository root; installed references from
+   `$OPENRIG_HOME/reference`; context-pack refs use `rig context get`. For a
+   Markdown `#section` address, use `loading-addressable-markdown` rather than
+   loading an entire unrelated manual. Expand the investigation when the task's
+   evidence requires it: the address map is a starting point, not a search limit.
+5. State briefly the user outcome, current role, candidate, selected path and
+   next completion boundary. No composition means the light Part A flow in
+   `sdlc-conventions.md#a1-the-flow-in-one-pass`. Do not author a
+   composition merely to have one, or mint QA, guard, review, lock or proof gates
+   because those roles exist. On a tiny change the builder can verify the whole
+   outcome; independent review happens only when selected.
+
+A missing referenced file is a named gap, not evidence of no selection. Inspect
+or ask the owner to resolve a consequential ambiguity; do not silently fall back
+from an explicitly selected rigorous path. An owner can explicitly amend the
+selection for named work; record that decision at the work's authority. Current
+command/source reality outranks stale YAML as a factual claim: record the
+mismatch, re-derive, and preserve the distinction between scope and observed state.
+
+Startup overlays, role guidance, available seats, old mode names and historical
+packets cannot add steps to this selection. They supply capabilities. Skills load
+when the selected work calls for them; there is no quiz, per-file ACK gate or
+universal preloading requirement.
+
 ## Blank-agent start
 
-An agent with only the base world install should:
-
-1. Read `mission.yaml`, then the active `slice.yaml`.
-2. Resolve the catalog address and only the additional addresses those files
-   name.
-3. State: **my role; the user outcome; the starting candidate; the
-   boundaries**.
-4. Follow the selected component edges and their stop conditions.
-5. If no composition exists, use Part A in `mission-slice-sop`.
-6. If current reality contradicts the YAML, stop treating the YAML as fact,
-   record the discrepancy, and re-derive from the public journey and source.
+Follow **Resolve the selected path** above before choosing work. For an authored
+wave, build and verify each slice with its local discipline and integrate serially
+where required; request independent review once when the authored wave boundary
+arrives. Do not start per-slice reviews while waiting. A separately selected
+rigorous slice retains its named checks. Review findings justify bounded repairs,
+not an automatic increase in process for the next round.

docs/reference/project-release-profile.yaml

@@ -0,0 +1,86 @@
+schema: openrig.project/v0alpha1
+kind: project
+metadata: { id: example }
+missions: { root: missions }
+lifecycle:
+  profile: release-boundary-v0
+  profiles:
+    release-boundary-v0:
+      required_steps:
+        - mission-outcome
+        - exact-release-candidate
+        - capability-delta
+        - exact-cut-substance
+        - release-verification
+        - git-canonicalization
+        - public-release
+        - parent-adoption
+        - record-shipped
+        - release-boundary
+      workflow:
+        entry: { role: orchestrator }
+        # Entry/ordinary custody and exception selection are separate decisions.
+        # Replace the example target with a declared member (rig ps --nodes --json).
+        # Inspect with workflow compile/show; adopt later corrections with workflow revise.
+        exception_routing: { orchestrator_role: orchestrator }
+        roles:
+          orchestrator: { preferred_targets: [orch@example] }
+        steps:
+          - id: mission-outcome
+            actor_role: orchestrator
+            depends_on: []
+            objective: Judge the mission's promised outcomes against retained evidence; name remaining gaps.
+            allowed_exits: [handoff, waiting, failed]
+          - id: exact-release-candidate
+            actor_role: orchestrator
+            depends_on: [mission-outcome]
+            objective: Establish the exact candidate and tree to which subsequent receipts apply.
+            allowed_exits: [handoff, waiting, failed]
+          - id: capability-delta
+            actor_role: orchestrator
+            depends_on: [exact-release-candidate]
+            objective: Reconcile the shipped capability description with this candidate's actual behavior.
+            allowed_exits: [handoff, waiting, failed]
+          - id: exact-cut-substance
+            actor_role: orchestrator
+            depends_on: [capability-delta]
+            objective: Obtain and judge independent substance admission for the exact release cut.
+            allowed_exits: [handoff, waiting, failed]
+          - id: release-verification
+            actor_role: orchestrator
+            depends_on: [exact-cut-substance]
+            objective: Judge privacy, package shape, conventions and mirrors, builds, tests, and clean-tree evidence for the exact admitted release candidate.
+            allowed_exits: [handoff, waiting, failed]
+          - id: git-canonicalization
+            actor_role: orchestrator
+            depends_on: [release-verification]
+            objective: Obtain the authorized canonical Git identity and reconcile it with the verified candidate.
+            allowed_exits: [handoff, waiting, failed]
+          - id: public-release
+            actor_role: orchestrator
+            depends_on: [git-canonicalization]
+            objective: Obtain publication authorization and the release owner's exact public artifact receipt.
+            allowed_exits: [handoff, waiting, failed]
+          - id: parent-adoption
+            actor_role: orchestrator
+            depends_on: [public-release]
+            objective: Obtain separately authorized parent adoption and judge its effect receipt.
+            allowed_exits: [handoff, waiting, failed]
+          - id: record-shipped
+            actor_role: orchestrator
+            depends_on: [parent-adoption]
+            objective: Record durable shipped truth after judging ceremony receipts; the post-release boundary follows.
+            allowed_exits: [handoff, waiting, failed]
+          - id: release-boundary
+            actor_role: orchestrator
+            depends_on: [record-shipped]
+            objective: >-
+              After the release ceremony, author one attributed disposition record
+              covering seat renewal and re-prime, memory distillation, destination
+              queue sweep, substrate teardown or retention, board freeze and clean-box
+              baseline, capability-delta absorption and expiry, and packaged-product
+              discoverability. These are agent-judged guides, not seven daemon gates.
+              Inspect beyond this packet when useful. Record reasoned not-applicable
+              or deferred dispositions and wait on live dependencies. Finish after
+              this boundary when no successor is authored.
+            allowed_exits: [done, waiting, failed]

docs/reference/project-workspace.md

@@ -73,6 +73,29 @@ ownership receipt. A later seat start with no project-world input preserves it;
 an explicit install whose `install.skills` is empty clears it. This keeps
 "project not supplied" distinct from "project deliberately selects no skills."
 
+## TUI project selection
+
+Open **PROJECTS** (or enter `projects`) to choose an ID and root from the
+configured workspace catalog. `project <id>` selects an exact catalog entry;
+`mission <directory>` then opens that project's execution view. The historical
+`scopes` machine section ID remains valid. Project selection and its canonical
+root travel through mission, slice, source-file and Back navigation. Changing a
+catalog root requires selecting it again. Missing or malformed sources remain
+unavailable; another project's matching work ID is never a fallback.
+
+`source` opens the current project, mission or slice's actual source through the
+existing file-reader allowlist. Catalog membership does not grant file-read or
+execution permission. These views only read; they do not select a lifecycle
+operation or activate a mission. Execution and slice queue membership require
+an exact `project:<id>` tag; lifecycle instances use their authored project
+identity. Unscoped historical queue rows and global review artifacts without
+project binding are excluded from project-specific claims.
+
+The read API adds `GET /api/scopes/projects` and optional `project` and
+`projectRoot` parameters to scopes, execution and slice-detail reads. Slice
+detail also requires the selected mission directory. Existing reads without a
+project parameter keep their legacy contract.
+
 ## UI Mapping
 
 - `workspace.root` maps to the Project workspace.

docs/reference/refocus-channel.md

@@ -61,10 +61,7 @@ unset, the existing FILE and generic paths are unchanged.
 Mission-, project-, or box-specific refocus text belongs in a context-library
 entry or one of those FILES on the instance that needs it. **It must never be committed into product
 source** — the shipped default carries no path, seat name, mission, or
-practice that is not generally applicable. (The pre-promotion lab hook had
-exactly this defect: a hardcoded per-box distillation-tool path. The
-promotion removed it; the grep for project residue is part of the slice's
-proof contract.)
+practice that is not generally applicable.
 
 Every delivered refocus pairs its content with the public `refocusing` skill's
 path-only trace. Configure `OPENRIG_REFOCUS_TREES=topology|work|both` and

docs/reference/release-boundary.md

@@ -2,29 +2,27 @@
 
 A CHECKLIST OF JUDGMENT GUIDES, not gates: every item says WHY, most items are one
 act, and anything situational expires at the next boundary. Runs once per release
-fence, after the prior release's ceremony completes. Graduated 2026-08-28 from the
-working SOP; the graduating team's seat-specific ceremony details stay in its
-playbook.
+fence, after the prior release's ceremony completes. The project and seat owners
+select the applicable actions and preserve their reasons in the boundary record.
 
 ## 1. Seats — reset or re-prime, per each seat's continuity needs
 
-- **Builder, QA, and reviewer seats: FRESH GENERATIONS.** Graceful exit with a
-  deposit (recap where provisioned), then relaunch. Why, twice proven: accumulated
-  release context becomes noise that reads as knowledge, and long-running seats
-  carry stale injected catalogs — only a fresh launch carries current skills and
-  canon.
-- **Planning seats: MANAGED COMPACTION + RE-PRIME,** not fresh — planning continuity
-  is the seat's point; the post-compaction restore is exactly the width-restore case
-  the context machinery exists for.
-- **The continuity-bearing orchestration seat: STAYS.** Its memory is the release's
-  memory and the ceremony's custody. Known cost, accepted: its injected catalog
-  stays stale until its own next generation — the capability delta covers the gap by
-  content.
+- **Choose continuity per seat, with its owner.** Fresh launch, managed compaction
+  with re-prime, or retaining the current session serve different needs. Role names
+  alone do not select one. Record the choice, the reason and custody of open work;
+  selecting a procedure does not itself authorize a lifecycle action.
+- **Fresh launch** can clear accumulated context and load current startup guidance.
+  Before an authorized exit, preserve the seat's earned knowledge and continuation
+  (recap where provisioned); verify the new occupant's actual identity and install.
+- **Managed compaction with re-prime** can retain planning continuity while
+  restoring the context needed for the next phase. **Retaining the current session**
+  can preserve ongoing custody. In either case, inspect which guidance is stale and
+  deliver the selected current context; an edit on disk is not delivery to a session.
 - **Re-prime = the world walk + the current capability delta + the mission install**
   per the mission-install convention (`docs/reference/mission-install.md`): the world
   half restores where-you-are; the project half (five layers, two depth profiles,
-  paced pointer-walk) restores what-you-are-doing. Composing the packet by
-  improvisation is the trap this convention closed.
+  paced pointer-walk) restores what-you-are-doing. Composing from named artifacts
+  keeps source precedence visible.
 - **THE CEREMONY IS THE EXPERIMENT.** Every act above runs on the product's own
   primitives, so the ceremony doubles as their live test. Observe passively: what did
   each re-primed seat's first natural turns reach for, and what broke? Findings land
@@ -45,13 +43,18 @@ playbook.
 - Every seat sweeps its DESTINATION for open rows (wakes are unreliable; the sweep
   is the read). Each open row from the finished release gets exactly one of:
   done-with-receipt · carried-to-the-new-mission (re-filed against the new plan,
-  never dragged) · closed-superseded. Ghost obligations accumulate silently without
-  this — the measured specimen was a dozen cold rows against one seat.
+  never dragged) · closed-superseded. The sweep exposes obligations that a missed
+  wake or a stale remembered work list can hide.
 - Verify every closing-paper inheritance has a live intake row with an owner. Zero
   orphans.
 
 ## 4. Substrate — teardown as its own atom
 
+- Retain the current release and the immediately previous release. At a boundary
+  for release N, worktrees and other release-scoped substrate from N-2 and older
+  are eligible for cleanup. Eligibility is not permission to discard unique dirty
+  bytes: archive or otherwise disposition those first. Identify live `main` and
+  runtime state by their actual refs and identity, never by a stale directory name.
 - Prune worktrees; remove session-scoped scratch trees; verify merged branches
   deleted (merge receipts authorize).
 - Scratch homes and scenario roots in temp directories: swept.
@@ -74,17 +77,22 @@ playbook.
 ## 6. The capability-delta lifecycle (standing law)
 
 Each release's capability delta is authored at the fence and bound to the exact
-published cut. Its baseline is the canon's actual last-absorbed marker, not an
-assumption that the immediately prior semver was absorbed. When canon is behind, the
-new delta is a cumulative synthesis of every intervening delta, preserving
-supersessions and pivots rather than concatenating old prose.
+candidate, then reconciled to the published cut. Its baseline is the canon's actual
+last-absorbed marker, not an assumption that the immediately prior semver was
+absorbed. When canon is behind, the new delta is a cumulative synthesis of every
+intervening delta, preserving supersessions and pivots rather than concatenating
+old prose.
 
-Canon absorbs the kept public-product truths; the canon header then names the delta,
-which EXPIRES it — verify the expiry fired, and never cite an expired delta. Private
-project topology, host practice, and release ownership go to the versioned project
-world instead of leaking into the public package. The new release's delta obligations
-start at ITS cut. A delta that outlives its absorption is a stale teaching site
-wearing a version number.
+Canon absorbs the kept public-product truths. Expiry requires BOTH the canon header
+naming that exact delta AND a distinct successor delta file existing. A header alone
+does not expire it; missing or unreadable inputs remain unknown/live. At the actual
+boundary, verify the event before recording expiry, then stop citing the expired
+delta. Do not create a successor merely to make the condition true. Candidate
+absorption is not proof of publication or served production adoption.
+
+Private project topology, host practice, and release ownership go to the versioned
+project world instead of leaking into the public package. The new release's delta
+obligations start at ITS cut.
 
 ## 7. World absorption and discoverability
 

docs/reference/rig-bundle.md

@@ -1,7 +1,7 @@
 # RigBundle Reference
 
 Version: 2 (pod-aware)
-Last validated against code: 2026-04-11
+Last validated against code: 2026-09-29 (install paths and `--target` only; other sections last checked 2026-04-11)
 Source of truth: `packages/daemon/src/domain/bundle-types.ts`, `packages/daemon/src/domain/bundle-archive.ts`, `packages/daemon/src/domain/pod-bundle-assembler.ts`
 
 A `.rigbundle` is a self-contained distributable archive that packages a rig spec, all referenced agent specs, their resources (skills, guidance, startup files), culture file, documentation, and an integrity manifest into a single file. The recipient can install and launch the rig without needing the original source tree.
@@ -180,6 +180,13 @@ If any check fails, extraction is aborted and an error is thrown.
 
 ## CLI Surface
 
+### Paths
+
+`rig bundle create`, `inspect` and `install` resolve every path you give them (`<spec-path>`, `-o`, `--rig-root`,
+`<bundle-path>`, `--target`) to an absolute path against **your** current directory before sending the request. The
+daemon then reads and writes those paths on **its own host**: nothing is uploaded, so the files must already exist
+where the daemon runs.
+
 ### Create a bundle
 
 ```bash
@@ -211,7 +218,7 @@ The create command:
 rig bundle inspect <bundle-path> [--json]
 ```
 
-Shows the manifest, digest validity, and integrity verification result. Inspect extracts the archive into a temporary directory for safe validation, then cleans that directory up. It does not install the bundle.
+Shows the manifest, digest validity, and integrity verification result. Inspect extracts the archive into a temporary directory for safe validation, then cleans that directory up. It does not install or launch anything.
 
 ### Install a bundle
 
@@ -222,12 +229,20 @@ rig bundle install <bundle-path> [--plan] [--yes] [--target <root>] [--json]
 | Flag | Required | Default | Description |
 |------|----------|---------|-------------|
 | `<bundle-path>` | yes | — | Path to the `.rigbundle` file. |
-| `--plan` | no | `false` | Preview the bootstrap plan without installing or launching. |
+| `--plan` | no | `false` | Preview without installing or launching. Not side-effect free: it runs the preflight, which executes the members' runtime `--version` probes, and it records a bootstrap run. It writes nothing to the target. |
 | `--yes` | no | `false` | Auto-approve trusted actions during apply mode. |
-| `--target <root>` | yes in apply mode | — | Target root directory for package installation. Required unless `--plan` is used. |
+| `--target <root>` | yes in apply mode | — | Directory the bundle is installed into and launched from. Required unless `--plan` is used. |
 | `--json` | no | `false` | Emit machine-readable JSON. |
 
-Extracts the bundle, validates integrity, and bootstraps the rig. In apply mode, the daemon requires `targetRoot`, so `rig bundle install` must be given `--target <root>` unless you are running with `--plan`.
+Install **launches the rig**; it does not just unpack it. It extracts the bundle to a temporary directory, validates integrity, and bootstraps the rig. In apply mode, the daemon requires `targetRoot`, so `rig bundle install` must be given `--target <root>` unless you are running with `--plan`.
+
+For a pod-aware (schema version 2) bundle, apply copies the extracted contents (`bundle.yaml`, `rig.yaml`, `agents/`, culture and docs files) into the target and launches from there, then removes the temporary extraction. So:
+
+- the target becomes the rig root: `agent_ref` paths resolve inside it, and a member with `cwd: "."` (or no `cwd`) starts in the target;
+- an absolute member `cwd` stays as authored, and `rig up --cwd <dir>` still overrides every member's cwd;
+- if the target already has a file with **different** content at any bundle path (for example its own `rig.yaml`), install refuses with `target_conflict` and writes nothing. Identical files are accepted, so reinstalling the same bundle into the same target works. Use an empty or dedicated directory as the target.
+
+Legacy (schema version 1) bundles keep their old behavior: `--target` is only where packages are installed.
 
 ### Launch directly
 
@@ -237,8 +252,9 @@ rig up <bundle-path> [--target <root>] [--cwd <dir>]
 
 `rig up` auto-detects `.rigbundle` files and routes them through the bundle bootstrap path.
 
-- `--target <root>` controls where packaged files are installed
-- if `--target` is omitted for a `.rigbundle`, the CLI defaults the install target to the current working directory
+- `--target <root>` is the install target described above (for a schema-version-2 bundle, the directory the bundle is copied into and launched from)
+- if `--target` is omitted for a `.rigbundle`, the CLI defaults the install target to the current working directory, so the bundle's files are written there
+- `rig up` resolves a relative `--target` against your current directory before sending it, like `rig bundle install`; with `--host`, `--target` is sent as given and must be a path that exists on that host
 - `--cwd <dir>` does **not** change the install target; it only overrides the launched members' working directory for that run
 
 ---
@@ -364,4 +380,4 @@ Equivalent explicit form:
 rig up /path/to/my-team.rigbundle --target ~/projects/my-project
 ```
 
-The bundle is extracted to a temporary directory, integrity is verified, packaged files are installed into the target root, and the rig is bootstrapped with all agents and resources from the bundle. If you also want agents to launch with a different working directory for that run, pass `--cwd <dir>` separately.
+The bundle is extracted to a temporary directory and its integrity is verified. A schema-version-2 bundle is then copied into the target root (refused if the target holds different files at the same paths) and the rig is launched from there, with all agents and resources from the bundle. If you also want agents to launch with a different working directory for that run, pass `--cwd <dir>` separately.

docs/reference/rig-spec.md

@@ -174,7 +174,8 @@ edges:
 | `name` | string | yes | — | Rig name. Used in session naming (`{pod}-{member}@{name}`), snapshot identification, and spec library lookup. |
 | `summary` | string | no | — | Human-readable description. Shown in spec library, review surfaces, and `rig specs show`. |
 | `culture_file` | string | no | — | Relative path to a rig-wide culture/constitution file. Must be a safe relative path (no `..`, no absolute). |
-| `permission_policy` | string | no | — | Permission policy attached to the rig. Either a built-in (`builtin:locked`, `builtin:standard`, `builtin:open`, `builtin:operator`) or a safe relative path to a custom policy file (resolved from this spec's directory; no `..`, no absolute). Absent leaves the default floor. A member may set its own `permission_policy`, which takes precedence over the rig-level one. See "Attaching a permission policy" below. |
+| `permission_policy` | string | no | — | Permission policy attached to the rig. Either a built-in (`builtin:locked`, `builtin:standard`, `builtin:open`, `builtin:yolo`) or a safe relative path to a custom policy file (resolved from this spec's directory; no `..`, no absolute). Absent leaves the default floor. A member may set its own `permission_policy`, which takes precedence over the rig-level one. See "Attaching a permission policy" below. |
+| `managed_blocks` | map | no | `CLAUDE.md` | File that receives OpenRig's managed instruction blocks for Claude Code members. Only the `claude-code` key is accepted, with `CLAUDE.md` or `CLAUDE.local.md`. Codex members always use `AGENTS.md`. See "Choosing the Claude instruction file" below. |
 | `docs` | Doc[] | no | — | Documentation files that should travel with the rig. Included in rig bundles. Each entry has a `path` field (safe relative path). The engine does not consume these — they are for humans and agents setting up the environment before launch. |
 | `startup` | StartupBlock | no | — | Rig-level startup files and actions. Applied to all members via the startup layering model. |
 | `services` | ServicesBlock | no | — | Optional managed services (Docker Compose). When present, services boot before any agent launches. |
@@ -193,12 +194,53 @@ permission_policy: builtin:standard
 permission_policy: policies/my-cautious-dev.policy.md
 ```
 
-Built-in policies (`locked` / `standard` / `open` / `operator`) are read-only and are
+Built-in policies (`locked` / `standard` / `open` / `yolo`) are read-only and are
 referenced as `builtin:<name>`. A custom policy lives in your own project and is
 referenced by a safe relative path (no `..`, no absolute). A shipped example of the
 custom shape is `packages/daemon/policies/examples/my-cautious-dev.policy.md` — copy it
 into your project and edit it to taste.
 
+This records a selection, not a live permission change. Flag-surface policies
+select launch flags; config-surface policies still need native configuration
+application and inspection. In particular, `builtin:yolo` selects Codex's
+`danger-full-access` sandbox and `never` approval policy, and replaces
+any `codex_config_profile` argument. See [practical permission choices](getting-started.md#opt-in-permissive-operation).
+
+An explicit `rig seat set-permissions` choice overrides member/rig policy for
+future managed launches of that stable seat; it does not rewrite this spec or
+its inherited policy provenance. `inherit` removes that override. See
+[per-seat permission mode](getting-started.md#per-seat-permission-mode).
+
+### Choosing the Claude instruction file
+
+OpenRig writes its instructions for Claude Code members into managed blocks in
+the member's working directory. By default the file is `CLAUDE.md`. If your
+repository tracks `CLAUDE.md`, write the blocks to `CLAUDE.local.md` instead:
+
+```yaml
+managed_blocks:
+  claude-code: CLAUDE.local.md
+```
+
+Claude Code loads `CLAUDE.local.md` from the working directory as well. By
+convention the file is kept out of git, for example with a `.gitignore` entry.
+
+- Accepted values are `CLAUDE.md` and `CLAUDE.local.md`. Any other value or
+  runtime key is rejected before a member launches.
+- The setting applies to launch, restore, relaunch, handover, adding members,
+  and export. `rig down` removes OpenRig's blocks from the selected file only.
+- OpenRig never edits, moves or deletes blocks in the other file.
+
+A rig that already wrote blocks into `CLAUDE.md` keeps them there after you
+switch. Until you remove them, `CLAUDE.md` stays modified and Claude Code loads
+both copies. Delete each `<!-- BEGIN OpenRig MANAGED BLOCK: … -->` …
+`<!-- END OpenRig MANAGED BLOCK: … -->` section by hand and keep the rest of the
+file. If `CLAUDE.md` has no other uncommitted edits you need to keep, you can
+instead run `git restore CLAUDE.md`; that command discards every unstaged change
+to the file, not only OpenRig's blocks. Running `rig down` on a rig that still uses
+the default is not a substitute: it strips every OpenRig block from that
+directory's `CLAUDE.md`, including blocks written by other rigs.
+
 ---
 
 ## Pod
@@ -229,6 +271,7 @@ into your project and edit it to taste.
 | `id` | string | yes | — | Member identifier. Must not contain dots. Must be unique within the pod. |
 | `agent_ref` | string | yes | — | Reference to an AgentSpec. Must start with `local:` (relative) or `path:` (absolute). Exception: `builtin:terminal` for infrastructure nodes. |
 | `profile` | string | yes | — | Profile name from the referenced AgentSpec. Use `default` for the default profile. Exception: `none` for terminal nodes. |
+| `codex_config_profile` | string | no | — | Codex-only native profile passed as `-p <name>`; letters, numbers, `_`, `.`, `-`. Separate from the AgentSpec `profile`. With the normal launch mode, this replaces OpenRig's explicit workspace-write sandbox flag. A full-bypass policy instead emits danger-full-access and omits this profile argument. |
 | `runtime` | string | yes | — | Agent runtime. Current supported values: `claude-code`, `codex`, `terminal`. |
 | `cwd` | string | yes | — | Working directory for the agent. Resolved relative to the rig root (the directory containing the rig spec). Use `"."` for the rig root itself. Can be overridden at launch time with `rig up --cwd`. |
 | `label` | string | no | — | Human-readable member name. Shown in UI when present. |
@@ -343,12 +386,51 @@ Startup blocks can appear at three levels: rig, pod, and member. They are merged
 
 | Field | Type | Required | Default | Description |
 |-------|------|----------|---------|-------------|
-| `type` | string | yes | — | Action type. One of: `slash_command`, `send_text`. Note: `shell` is explicitly NOT supported in v1. |
-| `value` | string | yes | — | The command or text to send. |
-| `phase` | string | no | `after_files` | When to execute. One of: `after_files` (after startup files are delivered), `after_ready` (after harness readiness check passes). |
+| `type` | string | yes | — | Action type. One of: `slash_command`, `send_text`, `startup_proof`. Note: `shell` is explicitly NOT supported in v1. |
+| `value` | string | yes | — | Command/text to send, or `authenticated` / `none` for `startup_proof`. |
+| `phase` | string | no | `after_files` | When to execute text/commands. One of: `after_files` (after startup files are delivered), `after_ready` (after harness readiness check passes). Proof selection is resolved before projection regardless of phase. |
 | `idempotent` | boolean | yes | — | Whether this action is safe to replay on restore. **Required field.** Non-idempotent actions must NOT include `restore` in `applies_on`. |
 | `applies_on` | string[] | no | `[fresh_start, restore]` | When this action runs. Subset of: `fresh_start`, `restore`. |
 
+### Startup proof selection
+
+Startup adds no orientation exercise by default. To select the authenticated
+startup challenge, declare an action in an agent, profile, rig, pod, member, or
+operator startup block:
+
+```yaml
+startup:
+  actions:
+    - type: startup_proof
+      value: authenticated
+      idempotent: true
+```
+
+Use `value: none` in a later layer to select lean startup explicitly. The last
+applicable declaration wins in agent → profile → rig → pod → member → operator
+order. Culture contributes files, not a proof selection. With no applicable
+declaration, the result is `none`; the number of startup files never selects
+proof. Invalid values and non-idempotent proof declarations fail validation,
+including declarations overridden later. These actions declare policy and are
+never typed into a terminal.
+
+An authenticated selection challenges only a fresh or fresh-fallback managed
+agent launch. Resumed, forked, rebuilt, and adopted sessions receive no new
+challenge; terminal nodes never receive one. `applies_on` follows the requested
+startup context, so a fresh fallback during restore uses `restore` selections.
+Keep the default `[fresh_start, restore]` to cover both fresh launch paths.
+
+Identity delivery, projection, readiness, and ordinary startup actions still
+run. `startup_status: ready` means startup completed, while `oriented: missing`
+means a selected proof awaits authenticated submission. Omission/`none` yields
+`oriented: n-a` on a new fresh launch and retires an older challenge without
+deleting its audit history. Retirement follows successful harness launch,
+before readiness checks, so attention, timeout, or a readiness exception cannot
+retain the preceding proof. A replacement that fails to launch does not retire
+the current proof; resume/adoption also preserves existing proof history.
+The effective selection is recorded on `node.startup_pending`; actions are
+persisted in startup context for restore and fresh relaunch.
+
 ---
 
 ## Services Block
@@ -477,7 +559,7 @@ These rules are enforced by the validator. A spec that violates any of these wil
 19. Each wait target must define exactly one of: `service`, `url`, `tcp`.
 20. `condition` is only valid on `service` targets and must be `healthy`.
 21. Startup file `delivery_hint` must be one of: `auto`, `guidance_merge`, `skill_install`, `send_text`.
-22. Startup action `type` must be one of: `slash_command`, `send_text`. (`shell` is explicitly rejected.)
+22. Startup action `type` must be one of: `slash_command`, `send_text`, `startup_proof`. (`shell` is explicitly rejected.) Proof selection requires `value: authenticated` or `none` and `idempotent: true`.
 23. Startup action `phase` must be one of: `after_files`, `after_ready`.
 24. Startup action `idempotent` is a required boolean.
 25. Non-idempotent actions must not include `restore` in `applies_on`.
@@ -491,8 +573,8 @@ These are the built-in specs shipped with OpenRig. Read them as worked examples.
 
 | Spec | Location | Pods | Members | Services |
 |------|----------|------|---------|----------|
-| `product-team` | `packages/daemon/specs/rigs/product-team.yaml` | orch, dev, rev | 7 (lead, peer, impl, qa, design, r1, r2) | no |
-| `implementation-pair` | `packages/daemon/specs/rigs/implementation-pair.yaml` | dev | 2 (impl, qa) | no |
-| `adversarial-review` | `packages/daemon/specs/rigs/adversarial-review.yaml` | orch, rev | 3 (lead, r1, r2) | no |
-| `research-team` | `packages/daemon/specs/rigs/research-team.yaml` | orch, research | 3 (lead, analyst, synthesizer) | no |
+| `product-team` | `packages/daemon/specs/rigs/preview/product-team/rig.yaml` | orch1, dev1, rev1 | 7 (lead, peer, impl, qa, design, r1, r2) | no |
+| `implementation-pair` | `packages/daemon/specs/rigs/launch/implementation-pair/rig.yaml` | dev | 2 (impl, qa) | no |
+| `adversarial-review` | `packages/daemon/specs/rigs/focused/adversarial-review/rig.yaml` | orch, review | 3 (lead, r1, r2) | no |
+| `research-team` | `packages/daemon/specs/rigs/focused/research-team/rig.yaml` | orch, research | 3 (lead, analyst, synthesizer) | no |
 | `secrets-manager` | `packages/daemon/specs/rigs/launch/secrets-manager/rig.yaml` | vault | 1 (specialist) | yes (Vault) |

docs/reference/scoped-operating-posture.md

@@ -0,0 +1,95 @@
+# Scoped operating posture
+
+Human-led work is quiet by default for process-only diagnosis. Delegated work can
+receive oversight during planning as well as implementation. This preference does
+not grant execution authority or change permissions, work phase, workflow reminders,
+context/continuity health, or health policy.
+
+## Inspect and choose
+
+Use the existing `rig mode` surface. Give an exact rig or authored work scope:
+
+```sh
+rig mode effective --rig my-rig --json
+rig mode effective --project my-project --mission release-1 --json
+rig mode effective --qitem my-packet --json
+rig mode set delegated --scope mission --qualifier my-project/release-1 --evidence "Operator delegated this outcome"
+# The proposal above exits 2 without writing. Apply the deliberate choice:
+rig mode set delegated --scope mission --qualifier my-project/release-1 --evidence "Operator delegated this outcome" --confirm
+rig mode set human-led --scope mission --qualifier my-project/release-1 --evidence "Return to interactive planning" --confirm
+rig mode unset mission my-project/release-1
+```
+
+Unsetting reveals the next applicable explicit choice, or the visible human-led
+product default. A new, resolved rig with no binding reports `human-led`,
+`source: product-default`, and `binding: null`. Missing scope identity, conflicting
+linkage, unavailable storage or malformed authored context reports `unknown` with
+a reason. Calling `effective` without a scope does not select a rig implicitly.
+The existing operator bearer requirement still applies. `set` requires `--confirm`;
+`unset` is an explicit deletion command and applies immediately.
+
+## One scope and phase contract
+
+`GET /api/rig-mode/effective` accepts `rig`, `project`, `mission`, `workstream`, and
+`qitem`. Its additive `operatingPosture` object is also attached to health records
+and diagnosis findings. CLI explanation and TUI health detail display the same data.
+Consumers of posture, phase, and health should use this object rather than invent
+another preference store or infer delegation from workflow existence or activity.
+
+| Field | Meaning |
+| --- | --- |
+| `posture` | `human-led`, `delegated`, or `unknown` |
+| `source` | `product-default`, `binding`, or `unknown` |
+| `context` | Resolved rig/project/mission/workstream/qitem IDs, source addresses, canonical authored paths and phase; null if scope resolution failed |
+| `context.phase` | `{value, source}` from an explicit workflow packet step, otherwise slice stage/status, otherwise mission release phase/status; null fields when unavailable |
+| `binding` | Winning binding ID, scope, timestamp and evidence citation; null for default/unknown |
+| `reason` | Explanation of the result or the missing/conflicting fact |
+| `grantsAuthority` | Always `false` |
+| `members` | For queue-backed findings, each member's qitem, posture, source and binding ID; differing or unknown member postures yield unknown aggregate posture |
+
+The existing SQLite mode-binding table remains the only preference store. Matching
+posture bindings resolve in this order: qitem, workstream, mission, project, rig,
+global host. The qualifiers are respectively a qitem ID, `project/mission/slice-id`,
+`project/mission`, project ID, canonical rig ID, and null. Rig names resolve to IDs.
+The workstream is an existing authored slice, found by its directory or SPEC ID;
+the returned identity uses its SPEC ID and project/mission qualification.
+
+Project selection reads `workspace.yaml`'s declared `projects: [{id, root}]`
+catalog, or the workspace's own `project.yaml` when no catalog exists. Multiple
+projects require an explicit project selection. A sole project may be derived.
+The project manifest validates identity and supplies `missions.root` (default
+`missions`). Mission and slice identities come from those authored work nodes;
+missing, duplicate or conflicting identities remain unknown. The selected work
+must stay inside its canonical project root.
+
+Qitem reads join explicit `project:`, `mission:`, `slice:`/`workstream:` tags,
+destination rig, and the existing workflow packet binding. Workflow lifecycle
+project/mission identity must agree with the tags and requested scope. The bound
+packet's exact step is the phase source; phase names are not classified by guess.
+An unlinked qitem does not silently inherit the default. Scope reads are observational.
+
+Legacy ergonomic modes (`sleep`, `desk`, `mobile`, `away`, `focus`, `debug`) retain
+their bindings and ten-field records. They do not imply either operating posture.
+Only human-led/delegated bindings participate in posture precedence. The legacy
+`effective` and `posture: known|unknown_posture` fields remain for compatibility;
+`unknown_posture` there means no legacy mode binding and does not override the
+new `operatingPosture.source: product-default` result. Setting another mode at the
+same scope replaces that row; inspect effective posture after any mode change.
+
+## Diagnosis effects
+
+Process-category findings remain visible under human-led or unknown posture, but
+new diagnosis presentations, re-presentations and human notifications require
+explicit delegated posture. Retained occurrences are not canceled or rewritten
+when posture changes. Their current finding is refreshed for inspection and
+notification; unavailable current findings cannot reuse old delegated posture.
+Notification admission is rechecked after readiness I/O.
+
+Delegation is necessary for process interruptions and is insufficient by itself:
+enabled diagnosis policy, detector selection, source freshness, custody, cooldown,
+recurrence limits and human delivery readiness still apply. Other health categories
+and ordinary queue/workflow reminders retain their existing behavior. The automatic
+ceremony source reads declared catalog projects through the same resolver; unresolved
+lineages remain visible with unknown scope instead of acquiring invented authority.
+
+See [health diagnosis](health-diagnosis.md) for policy, evidence and disposition.

docs/reference/sdlc-conventions.md

@@ -7,10 +7,10 @@
 
 OpenRig is a software factory the human steers from a high altitude. The human
 records intent; agents turn intent into a plan, the plan into a build, the
-build into proof. The TUI is a **plain projection of well-formed
-markdown on disk** — agents change the files, the UI re-projects. These
-conventions define "well-formed." Everything here is **advisory / fail-open
-for agents**: nothing below blocks a write; the audit records and advises.
+build into proof. The TUI projects authored work on disk and, where an owning
+proof policy is selected, derives readiness from recorded judgments. These
+authoring conventions are **advisory / fail-open for agents**: the audit
+records and advises; the selected proof policy separately governs who may judge.
 
 
 ## HOW TO READ THIS DOCUMENT — two parts, and only one of them is the default
@@ -38,7 +38,7 @@ one does not deprecate the others. Nothing below deletes or overrides an existin
 | **PLAN** | **The planning dial** — planning rigor is a spectrum chosen per piece: P0 mini-requirements and pointers (simple, reversible work) · P1 an authored spec with a proof contract (the default) · P2 plus a research round before the spec freezes, run BEFORE build dispatch · P3 plus an adversarial pass by a non-author, judged against product goals, landing amendments with proof-contract teeth · P4 plus a blind from-scratch design diffed against priors before proceeding. Dial up by what the piece is, exactly as build care is priced below. Full reference: `planning-dial.md`. |
 | **BUILD** | **Part A, the simple flow** (below — the default) · **product-journey components** — a mission-selectable menu for greenfield work, drift recovery, public journey probes, one evidence-gated look at the layer below, minimal repair, independent QA/review, integration, and installed smoke; compose only what the work needs in mission/slice YAML, never as a new mode or mandatory pipeline. Full reference: `product-journey-sdlc.md` · **the wave model** — slices build in parallel in disjoint file territories, an integrator merges serially, and independent review fires once per wave (two reviewers with different vantages, never the writers; fix rounds re-earn verdicts at one final revision; per-slice discipline stays failing-test-first and verify-by-effect). The wave IS the care dial: what shares a wave decides how much review each piece gets · **Part B, the rigorous overlay** (below — only when assigned). These combine: a wave can carry one Part-B piece. Full wave reference: `wave-sdlc.md`. |
 | **DISPATCH DATA** | **The execution-data conventions (S27)** — three tiny data disciplines that make execution state derivable instead of hand-tabulated, consumed by `rig view show execution`. **EC-1, edges in frontmatter:** every open slice carries its hard edges in `depends_on:` (an inline JSON array; an explicit `[]` is a statement, absence is INDETERMINATE); soft/serialization edges are one machine-readable Territory line, exactly `SOFT-AFTER: [ids] — reason`. **EC-2, wave-as-data:** wave composition + review model live on a durable queue row tagged `wave-map` + `format:wave-map-v1` whose body carries one fenced ```json block (`{format:"wave-map-v1", mission, waves:[{id, slices, serialized_order?, review_model?}]}`) — composition only, never status labels (status derives at read time); the planning dial recorded at lock surfaces as the frontmatter field `approved-spec-dial:` beside the approve stamp. **EC-3, dispatch names the worktree:** build batons carry the exact body line `worktree_path=<path>` from dispatch onward — it is Q1's join key; batons without it join by naming only and the view marks them `fragile_join`. Existing batons are never rewritten. |
-| **RELEASE** | The release ceremony conventions (publication identity, honest release notes) and the CAPABILITY-DELTA LIFECYCLE LAW: each release's delta is authored at the fence, bound to the exact published cut; canon absorbs its named items; the canon header then names the delta, which expires it — verify the expiry fired, and never cite an expired delta. Full statement: `release-boundary.md` §6. |
+| **RELEASE** | The release ceremony conventions (publication identity, honest release notes) and the CAPABILITY-DELTA LIFECYCLE LAW: each release's delta is authored at the fence and bound to the exact candidate, then reconciled to the published cut. Expiry requires both the canon header naming the absorbed delta and a distinct successor delta existing; a draft header alone is insufficient. Verify the actual boundary event and stop citing an expired delta. Full statement: `release-boundary.md` §6. |
 | **BOUNDARY** | **The release boundary** — housekeeping run once per fence so the next release starts clean: seats reset or re-primed per their continuity needs, memory distilled (keep what changed a decision recently), every queue swept by destination and dispositioned, substrate torn down, boards frozen as records, a clean-box baseline captured. A checklist of judgment guides, not gates. Full reference: `release-boundary.md`. |
 
 > Full reference documents for each component (graduated 2026-08-28): the
@@ -68,10 +68,12 @@ intent (what is this for, what does done look like)
       → hand off (rig queue handoff) or stop
 ```
 
-One full-breadth review at the end, not per increment. Bring work when it is **done**. The human
-should almost never see something that doesn't match what was planned — QA catches mismatches and
-kicks them back. When the human looks, they map intent → plan → delivered at a glance, mostly by
-scanning screenshots down a single column, and give the final 1% approval.
+Verify the whole outcome at completion, not through a review chain per increment.
+For a tiny change the builder may hold this check. Independent QA/review runs only
+when selected by the project/mission/slice composition or an explicit owner
+assignment; for a wave, at its authored boundary. Available roles never add gates.
+The authority lookup is `product-journey-sdlc.md#resolve-the-selected-path`.
+Bring work with evidence that its promised user outcome actually works.
 
 For a release mission, `mission.yaml` also names the Git strategy before build
 work starts: the branch/ref that is cumulative integration truth, its base, and
@@ -110,6 +112,17 @@ Legacy `README.md`, `IMPLEMENTATION-PRD.md`, and pre-convention trees remain
 readable indefinitely. New scaffolds do not create or mirror them, and repair
 is additive: it never deletes, renames, or rewrites legacy bytes.
 
+When the owning scope selects `proofPolicy.judges`, use `rig proof judge` to
+record an attributed accept, reject or withdraw decision on a contract item,
+and `rig proof show` to read derived readiness up through slice, mission and
+project. The nearest slice, mission or project policy selects authorized judges;
+`rig proof --help` describes setup, selectors and evidence requirements. A
+correction preserves history and unrelated judgments without editing ancestor
+status checklists. An artifact can identify non-code work without a fabricated
+commit. Evidence capture (`proof add`), policy acceptance, higher outcome
+judgment and publication are distinct. This optional component does not select
+Part B or add a mandatory review gate.
+
 The three sections project into the UI's one review structure: a vertical
 stack of **INTENT → PLAN → DELIVERED**. A slice missing a section still
 renders (the projection degrades to a muted "—", never invents content) —

docs/reference/slack-app-setup.md

@@ -0,0 +1,90 @@
+# Create your own Slack app for OpenRig (experimental)
+
+> **Experimental in 0.6.0.** The manifest (`rig slack manifest`) and this setup guide are new
+> and have not been confirmed against a real app creation. The Slack connector itself and its
+> `setup`, `verify`, `enable`, `disable` and `status` commands are not experimental. If a step
+> here does not match what Slack shows you, please
+> [open an issue](https://github.com/mvschwarz/openrig/issues/new/choose) or send a pull request
+> ([CONTRIBUTING.md](../../CONTRIBUTING.md)).
+
+OpenRig's Slack connector talks to a Slack app that you create in your own workspace. OpenRig
+ships the app's manifest; it does not host an app, run an install endpoint, or publish anything
+to the Slack Marketplace. The app is a Socket Mode app, so it lives in the one workspace you
+create it in.
+
+`rig slack manifest` prints the manifest. It works offline, before any daemon or token exists:
+
+```bash
+rig slack manifest          # the manifest as YAML
+rig slack manifest --url    # Slack's create-app link with the manifest prefilled
+rig slack manifest --json   # the manifest, its scopes and events, and why each scope is requested
+```
+
+The TUI shows the same link on the Connections page while Slack is not configured. Neither the
+CLI nor the TUI opens a browser, accepts tokens, or creates an app.
+
+## Steps
+
+These are the expected steps, based on Slack's app-manifest documentation. They have not yet
+been confirmed against a real creation run. Slack's form may ask for something the prefill did
+not fill in; if so, follow the form.
+
+1. Open the link from `rig slack manifest --url` in a browser.
+2. Sign in to Slack if asked, pick the workspace, review the prefilled manifest, and click
+   **Create**.
+3. Under **Socket Mode**, confirm it is enabled. Enable it if it is not.
+4. Under **Basic Information → App-Level Tokens**, generate a token with the
+   `connections:write` scope and copy it (it starts with `xapp-`).
+5. Install the app to the workspace and approve the requested scopes.
+6. Under **OAuth & Permissions**, copy the **Bot User OAuth Token** (it starts with `xoxb-`).
+7. Put both tokens in a private env file readable only by you (`chmod 600`):
+
+   ```bash
+   SLACK_BOT_TOKEN=xoxb-...
+   SLACK_APP_TOKEN=xapp-...
+   ```
+
+8. Run `rig slack setup --channel <channel-id> --secrets-env-file <path>`, then
+   `rig slack verify`, then `rig slack enable`.
+9. Invite the bot to the channel you configured (`/invite @OpenRig` in that channel).
+
+## What the app asks for
+
+Run `rig slack manifest --json` for the exact list and the reason for each scope. There are two
+groups:
+
+- **Baseline scopes**: posting messages, reading message history in public channels the app is
+  a member of, and reading channel details.
+  `rig slack verify` checks these.
+- **Feature scopes**: `files:read` (download attachments people send), `files:write` (upload
+  attachments to Slack), and `app_mentions:read` (receive @-mentions of the app). `rig slack verify`
+  does **not** check these, so a READY from verify does not prove attachments or mentions will
+  work.
+
+If a feature scope was not granted, the effect differs by feature:
+
+- **Attachments** (`files:read`, `files:write`): the file download or upload call fails. A
+  message with an attachment that could not be downloaded is still delivered, with the failed
+  file named in it. A post whose attachment could not be uploaded still delivers its text, and
+  the failure appears only in the daemon log (`rig daemon logs`).
+- **Mentions** (`app_mentions:read`): Slack does not deliver `app_mention` events to the app, and
+  nothing in OpenRig reports that they are missing.
+
+So after installing, compare the granted scopes Slack shows for the app with all six scopes that
+`rig slack manifest --json` lists.
+
+The app subscribes to messages in public channels it is a member of (`message.channels`) and to
+mentions of the app (`app_mention`). It does not request direct-message or private-channel access.
+
+## What the connector does with the tokens
+
+The tokens stay in the env file you created. The connector reads them from that file and uses them
+to authenticate to Slack: it opens an outbound Socket Mode connection with the app-level token and
+calls Slack's Web API with the bot token. This connector has no OpenRig-hosted component and
+makes outbound connections only. That statement is about this Slack connector, not about every
+part of OpenRig.
+
+## Next
+
+- `rig slack status` shows what is still missing, without contacting Slack.
+- `rig slack verify` checks the granted baseline scopes and channel membership with Slack.

docs/reference/stream-classifier-worker.md

@@ -0,0 +1,244 @@
+# Occupant-owned stream classification and shadow capture (experimental)
+
+> **Experimental in 0.6.0, optional and off by default.** The Jev classification path and shadow
+> capture may be incomplete or not work, and no accuracy or production-reliability claim is
+> made. OpenRig's delivery, watchdog and routing decisions do not use their output. If they do
+> not behave as described here, please
+> [open an issue](https://github.com/mvschwarz/openrig/issues/new/choose) or send a pull request
+> ([CONTRIBUTING.md](../../CONTRIBUTING.md)).
+
+This source provides a bounded receiver for one real classifier occupant. It does
+not start an agent, register a watchdog job, or enable capture by default.
+Taxonomy, questions and decisions belong to the occupant; the daemon supplies
+source facts and enforces its existing lease, execution and idempotency fences.
+An explicit optional Jev mode supplies advisory decisions through the same worker.
+Experimental labels have no demonstrated accuracy or calibrated confidence and
+do not replace delivery, watchdog, or routing decisions.
+
+## Optional foreground Jev experiment
+
+With no configuration, the experiment is off. Choose an explicit local JSON path
+in an existing private directory; the file contains only enabled state and bounds:
+
+```sh
+rig project experimental status --config ./experiment.json --json
+rig project experimental enable --config ./experiment.json --max-requests 3 --timeout-ms 10000 --json
+rig project experimental disable --config ./experiment.json --json
+```
+
+Enable does not start processing, capture, a daemon or an agent. Status and disable
+make no provider request. The invoking process needs `OPENROUTER_API_KEY` in its
+environment for an enabled run; this entry never searches credential files or
+copies credentials into configuration. Missing credentials fail before attempts
+or provider work. Normal key provisioning remains with the operator.
+
+The selected route is `https://openrouter.ai/api/alpha/decisions`, pinned to
+`typesafe/jev-1.13`, without provider fallback or HTTP redirects. A request declares
+maximum provider prices of $0.05 per million prompt tokens, zero completion and
+request price. These are admission ceilings, not a price quote, spend estimate or
+credential-access claim. Each foreground run allows 1–20 requests (default 3),
+each with a 1–30 second deadline (default 10), 24 KiB request and 256 KiB response
+limits. Failed requests consume their count. Nothing retries in the background.
+
+To process stream items from the actual selected occupant:
+
+```sh
+rig project wake --project PROJECT --taxonomy ./taxonomy.yaml \
+  --classifier-version experimental-jev-1.13 --evidence-epoch OWNER_EPOCH \
+  --limit 3 --experiment ./experiment.json --json
+```
+
+Use the taxonomy format described below. Each criterion must have a nonempty
+string description; `__unknown__` is reserved. Questions stay outside the daemon.
+The request sends the selected item's body, supplied taxonomy questions/criteria,
+canonical scope IDs and current roster destinations to OpenRouter. Select inputs
+appropriate for that external processing. It does not transmit the credential
+in evidence or store it in the classification. The output binds current source,
+taxonomy, candidate version, lease, occupant generation and attempt execution.
+No action or confidence label is inferred. Duplicate judgment remains manual.
+
+The smaller of `--limit` and the configured request maximum bounds the wake.
+Unknown answers remain null; a wholly unknown answer abstains. Invalid model,
+provider, answer keys, choices, probabilities or response bytes reject the whole
+answer. Probability sums retain the strict 0.001 tolerance; there is no rounding
+repair or partial salvage. Unavailable/invalid provider work stops that run with
+no classification write. Inspect the returned attempt state: terminal abstentions
+are not reopened, and failed/unknown daemon writes must be reconciled through the
+existing ledger. Never change the evidence epoch merely to retry an experiment.
+
+Disable is checked before each call and before applying its result. A separate
+disable command cannot cancel an already forwarded remote request; its late
+result is discarded, with the existing deadline bounding the wait. Ctrl-C or
+SIGTERM requests immediate cancellation of the foreground run. An uncooperative
+request remains reported pending and cannot cause a late write or a second call
+in that run. Remote cancellation or refund is not proven by local cancellation.
+The command registers no wake, returns no automatic continuation, and requires
+an explicit later invocation to do more work.
+
+For selected observations from an existing shadow archive:
+
+```sh
+rig project experimental capture --config ./experiment.json \
+  --input ./selected-shadow.jsonl --output ./new-advisory-results.jsonl --json
+```
+
+This reads at most 8 MiB and considers only the first configured maximum number
+of records. It never captures a terminal. The input remains unchanged; output is
+exclusively created at mode 0600. Keep prior output and choose another filename
+only for a deliberately selected new run. It sends captured post-screen text to
+the same provider, and retains the original attempt/node/occupant/pane binding and
+capture hash beside the answer. Missing capture or binding is unavailable and
+makes no provider call. State answers are experimental hints; delivery remains
+`INDETERMINATE` because screen text cannot prove submitted/consumed/effect and the
+archive does not retain the original sent text. No result feeds back into live
+transport or inventory. Failed runs preserve already written output; inspect
+`unavailable`, `remaining`, call count and stop reason rather than treating a file
+as proof of success.
+
+## One bounded wake
+
+From the selected occupant, read candidates using the configured project ID:
+
+```sh
+rig project candidates --project PROJECT --taxonomy /private/taxonomy.yaml \
+  --classifier-version VERSION --evidence-epoch OWNER_EPOCH --limit 20 --json
+```
+
+The result includes eligible stream IDs, authored scope IDs with exact source
+paths/hashes, the current running roster of the occupant's rig, observation time,
+and a candidate version. Taxonomy YAML supplies `version` and
+`fields.{kind,urgency,maturity,area}` with a `question` and `values` mapping. These
+questions are returned to the occupant; draft values are not verified truth.
+Confidence has no selectable values until calibration selects that contract.
+Destination choices are the current roster sessions plus explicit `pool`.
+Null/omitted destination remains unknown; it is not converted into `pool`.
+The candidate hash binds the selectable values as well as source and taxonomy
+hashes. Packets prepared before this pool correction require fresh preparation;
+it does not reopen historical attempts or change the evidence epoch.
+
+Read each eligible item with `rig stream show ITEM --json`. Duplicate candidates
+are the latest 100 nonarchived items with exact body-hash evidence references;
+their preview is capped at 2,000 characters and marked when truncated. Read the
+complete candidate before selecting a duplicate. A retrieval miss means unknown.
+Directory names, issue IDs and bare membership never supply scope IDs. Source
+errors are explicit, and partial source snapshots cause abstention.
+
+Write an occupant-owned decision file (at most 100 unique item IDs, at most 1 MiB):
+
+```json
+{
+  "candidateSetVersion": "sha256:<version returned by candidates>",
+  "decisions": [{
+    "streamItemId": "<eligible ID>",
+    "bodyHash": "sha256:<SHA256 of the exact UTF-8 item body>",
+    "decision": { "kind": "classify", "labels": {
+      "classificationType": "<selected taxonomy value>",
+      "scopeRef": "<selected canonical mission or slice ID>",
+      "needsHuman": null
+    }}
+  }]
+}
+```
+
+An explicit abstention is `{"kind":"abstain","reason":"why unknown"}`. Other
+label keys are `classificationUrgency`, `classificationMaturity`,
+`classificationDestination`, `area`, and `classificationConfidence`. Omitted or
+null labels stay unknown. A duplicate needs both `duplicateOfStreamItemId` and
+the matching `duplicateEvidenceRef` from the candidates, plus occupant judgment
+that it really is a duplicate. An existing item alone is not that judgment.
+
+```sh
+rig project wake --project PROJECT --taxonomy /private/taxonomy.yaml \
+  --classifier-version VERSION --evidence-epoch OWNER_EPOCH --limit 20 \
+  --decisions /private/decisions.json --json
+```
+
+This command actually invokes one `StreamClassificationWorker.wake()` through
+the existing HTTP services. It derives sender identity through `DaemonClient`,
+requires a current running occupant, and carries the captured generation through
+each lease/attempt/classification request. It never invents a daemon holder.
+Existing direct HTTP callers keep their documented sender-provenance behavior.
+
+The command refreshes source candidates before acquiring a lease. Missing or
+stale decision packets return unavailable without starting attempts; refresh
+preparation if the roster, scopes, taxonomy or recent stream changed. During a
+wake, an item with no exact body-bound decision, missing sources, or a selected
+candidate that is unavailable abstains. This is deliberately strict; continuous
+source churn can require repeated preparation and is not a throughput claim.
+
+Each wake processes at most `--limit` items (1–100; default 20), starting with the
+oldest eligible work rather than relying on a lossy notification cursor. Durable
+terminal attempts stay excluded. A new candidate version does **not** authorize
+another pass: only an owner-selected evidence epoch changes that attempt identity.
+Retain the candidates output beside the decisions and result so its version is
+reproducible. The CLI does not keep a second local ledger.
+
+The result carries per-item outcomes, `moreEligible`, `nextWakeAt`, and a watchdog
+`wakeRequest` descriptor with the real session/generation and a receiving
+instruction. `registered:false` is literal. A periodic-reminder message asks the
+occupant to prepare and run this entry; delivery of that message is not execution.
+Registration/placement remains an explicit later action. Honor `nextWakeAt`:
+lease maintenance uses TTL/3 opportunities; lease loss or an unavailable service
+backs off 60 seconds. The daemon's retry/exhaustion ledger remains authoritative.
+The ordinary client bounds each request at five seconds; a timed-out write has
+an unknown outcome until the ledger is read, and is never reported as written.
+
+There is no provider in the manual-decision path. The reusable asynchronous worker has one
+pending classifier slot; timeout requests cancellation but cannot force it. An
+uncooperative classifier blocks further calls in that instance and late results
+cannot write. That in-memory pending slot is not cross-process cancellation.
+
+## Separate bounded shadow drain
+
+The production transport and inventory probes accept the same optional observer.
+They record only captures already taken, with the node, occupant, pane and capture
+target bound before awaits. The ordinary cheap inventory path still takes no
+capture. Retained-no-write is a separate event, never delivery evidence.
+
+Activation requires explicitly supplied `OPENRIG_SHADOW_CAPTURE` JSON at a later
+authorized daemon start. Absence or invalid configuration leaves capture disabled.
+This document supplies no live destination or activation instruction. Required
+fields and engineering ceilings are:
+
+| Field | Meaning | Maximum |
+|---|---|---|
+| `destination` | New absolute JSONL file in a canonical, current-user-owned 0700 directory | Explicit path |
+| `maxRecords` | Total reserved sink records | 100,000 |
+| `maxBytes` | Total reserved sink bytes, including newlines | 1 GiB |
+| `capacity` | Queued observation count | 1,000 |
+| `maxQueuedBytes` | Serialized bytes waiting in the queue | 8 MiB |
+| `maxObservationBytes` | Serialized bytes per observation | 1 MiB |
+
+All numeric fields are required positive safe integers. These are engineering
+capacity limits, not approved corpus sizes or classification thresholds. One
+in-flight drain can hold up to 64 additional observations, bounded by the queue's
+byte allowance; queue plus drain can therefore retain up to twice that allowance.
+The standalone observer defaults are 256 entries, 4 MiB queued and 256 KiB per
+observation; explicit production configuration supplies each value.
+
+`rig project shadow-status` only inspects configuration/counters.
+`rig project shadow-drain` asks the existing HTTP service to drain up to 64 rows;
+it requires an actor and never enables capture. No background drain timer is added.
+`rig project shadow-stop` disables new enqueueing immediately, finishes any active
+drain and the finite retained queue, then closes the sink. Repeated stop is
+idempotent; it cannot enable capture or delete the existing archive. Existing
+quota and sink-failure losses remain counted. A slow disk can leave stop pending;
+inspect status after a client timeout instead of assuming the flush completed.
+Enabling capture again requires a separately authorized daemon start with a new
+destination; enabling the local provider experiment does not enable capture.
+The file is exclusively created with mode 0600. An existing file is refused,
+never overwritten, appended, rotated or deleted. A restart requires a new selected
+destination. Private-file creation currently requires POSIX ownership support.
+
+The hot path only performs bounded synchronous enqueue work; it never awaits disk
+or drain completion. Slow sinks leave one drain pending; concurrent drains do not
+start another writer. Overflow drops new observations. Capacity exhaustion stops
+the sink. Errors stop writes, count losses and preserve any partial file; failed
+batches are not replayed. `reservedRecords/Bytes` include attempted writes, while
+`completedRecords/Bytes` count successful appends. `drained` means removed from
+the observer, not necessarily persisted. Queue count drops, byte-bound drops,
+record errors, missing/unavailable captures and sink failures remain separate.
+
+Live collection, private destination/retention selection, corpus labels, hosted
+calibration, native placement, package/install proof and independent visible /
+submitted / consumed / effect evidence remain outside this source entry.

docs/reference/wave-sdlc.md

@@ -1,9 +1,9 @@
 # The wave SDLC — parallel build, wave-level review, composition as the care dial
 
-Graduated 2026-08-28 from the working playbook of the team that proved it live; the
-team-specific custody mechanics stay in that team's playbook. Lock stamps in this
-model are ADDITIVE: approval appends metadata and never rewrites authored bytes, so
-a candidate's identity survives its own approval.
+This is a selectable build and review model from `sdlc-conventions.md`'s component
+menu. The mission owner decides whether it fits the work. Lock stamps in this model
+are ADDITIVE: approval appends metadata and never rewrites authored bytes, so a
+candidate's identity survives its own approval.
 
 ## The model in one paragraph
 
@@ -87,7 +87,7 @@ design session first). Anything irreversible within the hour (publish, cutover,
 destructive operations) — that is the heavy path. And when no independent non-writing
 reviewers exist: nothing ever self-reviews; without them the wave gate is theater.
 
-## Failure modes, with the mitigations that worked (dated observations, 2026-08)
+## Failure modes and mitigations
 
 - **Freeze-merge races:** a candidate freezes seconds before a merge moves the tip.
   Mitigation: zero-overlap restack with content-identity proof (stable patch-id) in
@@ -100,14 +100,3 @@ reviewers exist: nothing ever self-reviews; without them the wave gate is theate
   line still prints. Rule: pin the ABSENCE of the false claim in every encoding.
 - **Phantom checkout status:** merge-by-reference leaves a shared checkout's index
   stale. Never build or commit from a shared checkout; sync its index at fences.
-
-## Measured outcome from the proving run (dated, one team, 2026-08)
-
-Eight slices plus five fix candidates plus two addenda built and merged in ~2.5 hours
-across five writing seats; two wave passes plus three fix-round passes replaced ~20
-per-slice review rounds. Defect yield went UP: the reviewers' findings never
-overlapped once across three consecutive verdicts, and the builders' green suites had
-missed every one of them — wave-level review sees cross-slice seams per-slice review
-structurally cannot. Correction latency: one live defect went found→root-caused→
-specced→locked→built→merged in 24 minutes, because no review round stood between a
-locked spec and a building seat.

docs/reference/worktree-builds.md

@@ -21,11 +21,11 @@ A worktree can therefore report green against code it does not contain.
 
 ## Rules
 
-1. **Run `npm install` in each worktree** (~4s, one time). It is not the slow path; it is the
-   only path that resolves workspace packages to the worktree's own source.
+1. **Run `npm install` in each worktree** so workspace packages resolve to the
+   worktree's own source.
 2. **Never symlink `node_modules` from the primary checkout.** It appears to work — builds pass,
    typechecks pass — which is exactly the danger.
-3. **`npx tsc` with no `node_modules` installs an unrelated 12-year-old `tsc` package** and prints
+3. **`npx tsc` with no `node_modules` installs an unrelated `tsc` package** and prints
    "This is not the tsc command you are looking for". That message means *no install*, not a
    TypeScript error.
 4. **Build `@openrig/daemon` before typechecking `@openrig/cli`** in a fresh worktree: cli imports

docs/releases/v0.5.10.md

@@ -0,0 +1,89 @@
+# OpenRig v0.5.10 — explainable System Health
+
+OpenRig 0.5.10 makes fleet health inspectable without turning observation into
+another source of work. Agents and operators can query the same bounded,
+evidence-bearing findings in the CLI and TUI, hand uncertain patterns to an
+agent for diagnosis, and route a verified human request when project policy
+requires it. The release also carries authored mission context through workflow
+waits, so lifecycle progress no longer depends on an orchestrator remembering
+the ceremony.
+
+## System Health
+
+- **Inspect health at the scope you actually own.** `rig health` supports the
+  current seat, a stable seat ID, a rig, or the local instance. Each finding
+  retains its category, severity, status, confidence, source window, freshness,
+  rule, evidence, policy version, and smallest useful next inspection. Empty
+  output explicitly does not claim health.
+- **See the same truth in the terminal UI.** Instance, rig, and seat views expose
+  compact health summaries, a HEALTH list, and finding drill-in from the same
+  canonical records used by the CLI. There is no second score or TUI-only health
+  authority.
+- **Detect high-confidence operational failures without transcript sentiment.**
+  Deterministic detectors cover process, governance, and context signals such as
+  queue amplification, authority-boundary traffic, and context pressure. Stable
+  episode identity, source bounds, freshness, and explicit indeterminate states
+  prevent missing or stale evidence from reading as healthy.
+- **Ask an agent to diagnose the cases code cannot settle.** Opt-in health policy
+  can present one bounded investigation packet for ceremony amplification. The
+  assigned agent may inspect beyond the packet, record an attributed disposition,
+  and request human notification only under configured policy and connector
+  readiness. Diagnosis traffic is excluded from its own detector input.
+
+## Durable lifecycle and human delivery
+
+- **Carry authored mission context through workflow waits.** A mission can select
+  an explicit boundary workflow in `mission.yaml`; compilation includes the
+  project and mission manifests plus declared context references. Waiting steps
+  can re-present the same packet with bounded exponential backoff, preserving one
+  obligation rather than manufacturing replacement rows.
+- **Select SDLC care from authored components and waves.** Shipped role and pod
+  guidance follows the project and mission selection instead of inferring a
+  builder-to-QA-to-review chain from seat names. Role capacity does not create a
+  gate.
+- **Address humans through registered delivery channels.** Registered
+  `<entityId>@external` addresses expose readiness and a next inspection. A
+  verified queue create persists the request before checking its receipt, while
+  posted, pending, failed, and indeterminate outcomes remain distinct. Direct
+  replies return through the correlated queue thread instead of being rewritten
+  as terminal input.
+
+## Upgrade and setup notes
+
+- Root, CLI, daemon, and web UI package versions advance to `0.5.10`. The
+  terminal TUI keeps its independent `0.1.0` version.
+- This release adds no database migration beyond the `0.5.9` migration head.
+  Normal daemon restart is sufficient for schema state; runtime adoption remains
+  a separate operator decision.
+- Health list and explain are read-only. Automated diagnosis is disabled until a
+  policy explicitly enables it, and no detector automatically retries, reroutes,
+  relaunches, edits scope, or changes lifecycle state.
+- Human delivery requires a registered address and a configured, enabled, ready
+  connector. Connector setup or verification does not itself send a message.
+
+## Known limitations
+
+- Deterministic shipped detector domains are process, governance, and context.
+  Behavioral and epistemic conclusions remain attributed agent judgment rather
+  than opaque scoring.
+- System Health observes bounded retained records. Unsupported, clipped, stale,
+  contradictory, or unavailable inputs stay indeterminate; absence of a finding
+  is not proof that the system is healthy.
+- Mission-boundary workflows carry context and scheduling, but agents retain the
+  judgment about evidence, publication, and activation. The daemon does not
+  interpret Markdown receipts or invent the next mission.
+- Slack is one human-delivery connector, not the addressing contract, and a
+  posted receipt proves connector acceptance rather than human readership.
+
+## Release verification
+
+- The accepted product frontier is exact commit
+  `b26419182d98f65ddc8f5cf1997d0b3a9bfe6f0f`, tree
+  `7b311e5dca2086266a682b7ebb43f68a70344d3b`.
+- Mission evidence includes positive, negative, stale, and indeterminate health
+  fixtures; CLI/TUI parity; an author-excluded diagnosis, human-request, reply,
+  and workflow-wake journey with zero real external sends; and live negative
+  dogfood of the 5/10/20/40/60-minute workflow backoff.
+- Release preparation rebuilds and tests the exact clean versioned descendant.
+  Publication, tagging, pushing, and runtime adoption are separate lifecycle
+  actions and are not implied by this private cut.

docs/releases/v0.5.11.md

@@ -0,0 +1,101 @@
+# OpenRig v0.5.11 — clearer first use, workflows, and everyday operation
+
+**Status:** release candidate. Publication and final release verification are
+separate steps.
+
+OpenRig 0.5.11 makes it easier to start useful work in an ordinary repository,
+understand the team and its workflow in the TUI, and diagnose configuration or
+lifecycle failures without mistaking uncertain state for success.
+
+## First useful work and a shared view
+
+- The `first-project` starter provides a focused Codex owner/checker pair for
+  one repository. The README follows that path from launch through a useful
+  change, independent checking, and returning to the work.
+- A new kernel includes a shared TUI terminal. `rig tui --shared` attaches to
+  that existing view; plain `rig tui` opens a standalone view. Joining the
+  shared view does not silently launch a missing terminal or agent.
+- Herdr users can follow the same repository and terminal journey. This is
+  preparation for useful operation without a plugin; no Herdr plugin or
+  community-adoption result is part of this release.
+
+## Understand work in the ordinary TUI
+
+- Mission views expose workflows, their current step and owner, waits, and
+  the work packet behind a transition. Source navigation connects the view
+  to the authored work and specs.
+- Specs presents the declared purpose, including a rig's `summary`, and
+  distinguishes missing content from a failed read.
+- Connections shows the running daemon and CLI identities, effective instance
+  settings, configured and applied gateway state, and registered human routes.
+  It is a passive inspection surface; a configured connector is not proof
+  that a person received a message.
+- Command completion, readable Recent activity, and a persistent configurable
+  timezone make daily navigation easier. The default display timezone is
+  America/Los_Angeles.
+- A timed-out daemon probe stays unverified throughout the TUI chrome instead
+  of being labeled as a confirmed outage.
+
+## More reliable coordination and lifecycle
+
+- Project-owned release profiles provide reusable ceremony and post-release
+  boundary steps. Current-release closure does not depend on inventing a
+  successor mission. Agents still judge the evidence behind each obligation.
+- Workflow exception recovery preserves the correct owner and clears resolved
+  exception state. Stuck-work findings retain the source evidence needed to
+  route them honestly.
+- Terminal delivery preserves long authored context; paced-walk verification
+  checks the intended piece and the applicable runtime/generation record.
+  Delivery and native-turn completion remain distinct from comprehension.
+- Context profile and work-install commands accept consistent Claude runtime
+  spellings (`claude-code` and `claude`) alongside `codex`, with invalid
+  explicit values rejected before projection.
+- Startup uses the selected authored proof. It does not add an unrequested
+  exercise, and terminal-only members do not receive agent proof challenges.
+- Daemon shutdown has a bounded budget and an attributed outcome receipt.
+  Failed or missing receipts remain visible on the supported stop paths.
+- Daemon startup binds success and state publication to its actual child,
+  handles competing starts, and retains uncertainty when child liveness
+  cannot be established. Cross-host request attribution identifies the origin
+  independently of the selected destination.
+
+## Operator notes
+
+Root, CLI, daemon, and web-UI package versions are 0.5.11. The terminal TUI
+retains its independent 0.1.0 package version. Node requirements are unchanged.
+The ordered database migration head remains `079_workflow_lifecycle_parallel`;
+this release adds no migration beyond the 0.5.10 source baseline.
+
+Diagnosis `show` and `list` now return summary-depth `--json`, retaining current
+state and decisions while identifying omitted evidence. Consumers needing the
+complete record must use `--full --json`, or execute the printed expansion
+command. Queue `show` retains its 512-codepoint body preview and adds explicit
+size, completeness, and expansion metadata. HTTP responses and mutation JSON
+remain complete. These defaults are not a global output-size cap.
+
+Use the supported upgrade procedure with a database backup and continuity
+checks. A daemon restart and a rig shutdown have different effects; the latter
+stops seats. Existing kernels are not automatically rebuilt to acquire the new
+shared terminal.
+
+## Validation scope and limitations
+
+The candidate retains earlier isolated, installed-package evidence for the
+connected first-project/workflow/TUI journey and focused verification of the
+purpose and unverified-state corrections. Those earlier runs are attributed
+prior evidence, not new end-to-end or provider enrollment tests for this cut.
+Package identity and bounded installed rendering checks accompany candidate
+preparation; exact-cut substance and final release verification remain required
+before publication.
+
+- First-use evidence includes fresh re-entry; it does not establish
+  same-conversation resume or complete mixed-runtime enrollment.
+- Controlled Connections evidence and passive inspection do not establish
+  external human delivery. Transient probe latency and delayed view population
+  remain observed qualifications, with no universal responsiveness claim.
+- Authored completion, legacy provenance, and proof pairing are separate
+  readers. Updating a declaration does not create missing provenance or an
+  execution-wave history.
+- A bounded health-analysis proof of concept produced an attributed diagnosis
+  and exited. It is research evidence, not a shipped cold-agent/run API,
+  provider abstraction, or proof of a cost or latency advantage over residency.

docs/releases/v0.5.12.md

@@ -0,0 +1,114 @@
+# OpenRig v0.5.12 — coherent work, quiet waits, and a normal TUI front door
+
+**Status:** release candidate. Exact-cut substance review, final release
+verification and publication remain separate steps.
+
+OpenRig 0.5.12 connects everyday workflow actions to useful progress views,
+recoverable ownership and a readable TUI. The goal is to let an operator or
+agent start, understand, adapt and return to work without maintaining status
+copies or knowing a private recovery recipe.
+
+## Record a judgment once
+
+An authorized, evidence-backed proof judgment derives the affected proof,
+slice, mission and project readiness. Correcting that judgment updates its
+dependent views while retaining unrelated work and the original evidence.
+Code, attributed patch-equivalent work and non-code artifacts can carry
+truthful provenance. A checkbox, uploaded file or closed queue item does not
+become semantic acceptance, and readiness does not mean publication.
+
+## Know which graph is running
+
+Ordinary workflow inspection distinguishes authored scope from the bound
+running graph, advisory ordering from executable dependencies, and planning
+waves from runtime steps. `rig workflow revise` previews supported changes
+before applying them, preserving completed work and current custody.
+Incompatible edits name the decision that needs reconsideration. Operation
+identity and `rig workflow operation` recover an ambiguous creation/revision
+result without duplicating its effect. Selected development-method guidance
+returns with workflow continuation, including the original story and useful
+next action; the daemon does not judge the meaning of agent-authored prose.
+
+## Give failures an owner and a recovery path
+
+Exception readiness explains the selected owner before failure and keeps
+missing configuration, a genuine no-match and unavailable routing evidence
+distinct. Routing uses authored agent identities or registered human fallback.
+An unhandled dependency-branch failure records its occurrence, owning task
+and wake together, even when another branch remains live. A failed nudge does
+not erase the task. After correcting the cause, use `rig workflow resume`
+with `--occurrence <failed-qitem-id>` to select that failure: its obsolete
+exception closes in the redrive transaction, while other unresolved failures
+and completed work remain visible.
+
+## Wait quietly without losing work
+
+Healthy unchanged waits avoid repeated full-context packets. Overlapping
+notifications for the same actionable episode share presentation and retain
+provenance. Changed blockers, missed delivery and stranded work retain bounded
+recovery or escalation. Ordinary reads expose the current owner, blocker and
+next useful decision first, with explicit expansion for complete evidence.
+Unknown activity remains unknown; a reminder is not progress.
+
+## Start and return through the same TUI
+
+Bare interactive `rig` is the normal front door, including first setup,
+daemon-down startup and return after a restart. The TUI shows the intended
+instance and observed prerequisites, offers daemon startup, and supports
+selecting the rigs and seats to return to work. Kernel is recommended first;
+unselected rigs keep their histories. Resume preserves the selected seat's
+recorded conversation when available. An unavailable resume offers a named
+repair or an explicitly confirmed fresh, re-primed conversation; it is never
+silently replaced. Launcher and native startup fixes retain useful errors
+when a runtime or dependency is unavailable.
+
+## Browse general instance settings in CONFIG
+
+CONFIG organizes instance, workspace/context, display/timezone, waiting,
+snapshot and recovery settings into readable categories with source and
+override provenance. Advanced settings and full values remain discoverable.
+Slack and human connections are one child of CONFIG. Opening or refreshing
+the browser is passive and secret-safe; configured values remain distinct
+from observed application, connectivity and delivery. Users can return to
+ordinary scope and work views without opening configuration files.
+
+## Operator notes
+
+Root, CLI, daemon and web-UI package versions are 0.5.12. The terminal TUI
+retains its independent 0.1.0 version. Node requirements and the ordered
+migration head `079_workflow_lifecycle_parallel` are unchanged from 0.5.11;
+this release adds no database migration.
+
+Use the supported upgrade and continuity procedure when adoption is authorized.
+Preparing this candidate does not restart a daemon or renew existing seats.
+Configuration inspection is not an editor, credential migration, automatic
+repair or a promise that every setting hot-reloads. Editing an authored graph
+alone does not adopt it into a progressed workflow. The exception repair does
+not retroactively create tasks for failures already committed by older code;
+inspect retained occurrences and use the supported recovery route deliberately.
+
+## Validation scope and known limitations
+
+The accepted development outcome includes one less-primed, returning/assisted
+agent journey through two dependent slices: recording and correcting proof,
+revising the graph, waiting and returning, recovering a real failed handout
+check, and navigating CONFIG back to work. Focused mechanism reviews and
+installed controls support that journey. Native startup, resume and wake
+observations retain their original source cuts and times; they are reused
+with attribution, not presented as new runs on the version-only candidate.
+Candidate package and generated-version checks are recorded separately from
+those development judgments.
+
+- This was not an unfamiliar-human study, an unassisted greenfield usability
+  trial or all-platform verification. Setup and one-time native approvals
+  remain part of the recorded journey.
+- The final exception task was consumed through public read/claim/action
+  after its placeholder destination could not receive a nudge. It does not
+  establish native exception delivery or external human receipt.
+- Quiet-wait measurements establish the tested workload's attention and
+  recovery behavior, not a global latency guarantee or provider billing-token
+  savings. A retained startup catalog-unavailable control also failed on its
+  unchanged parent; the evidence is not an all-green test-suite claim.
+- Whole-package substance review, exact-release verification and publication
+  must still bind this prepared candidate. These notes do not announce an
+  available npm release or authorize runtime adoption.

docs/releases/v0.5.13.md

@@ -0,0 +1,131 @@
+# OpenRig v0.5.13 — read, decide, and return to work
+
+**Status:** release candidate, unpublished. Exact-cut substance review,
+release verification and publication remain pending. This candidate has not
+been adopted into a live installation.
+
+OpenRig 0.5.13 connects the human TUI journey: enter the instance, choose a
+project, read its current instructions, understand what needs your decision,
+and deliberately open the terminals you need. Scoped oversight and explicit
+Git context updates help agents work from the right instructions while keeping
+authority, evidence and local authorship visible.
+
+## Start with something useful
+
+Bare interactive `rig` exposes Help, Skip and local reading while startup
+checks are running, when the daemon is down, or when its state is unverified.
+Selected project, mission and slice intent can be read from disk without
+pretending it is live queue, execution or topology data. Read failures and
+source provenance stay visible. Starting a daemon or returning seats to work
+remains a deliberate action; reading and skipping do not imply consent.
+
+## Read the current source and find your way back
+
+PROJECTS keeps a selected project's identity and root through missions,
+slices and source views, including projects with the same display name.
+An unavailable source is reported for that project instead of substituting
+another project's work. Refresh reads the current file.
+
+The shared reader shows source paths, modification/hash information and
+bounded content, with scrolling, local links, heading links and Back.
+HTTP(S) links show a selectable destination for copying; no browser is opened.
+Missing, unreadable, binary or out-of-root files remain named errors. Large files show the
+1 MiB returned-content limit; a heading absent from a truncated prefix is
+not claimed absent from the whole file. Back restores the prior reading
+and navigation position.
+
+## Know what needs your decision
+
+ATTENTION separates **Action required** from **Updates**. Human requests
+and explicit blockers show the request, urgency, scope and work it would
+unblock. Outcome and health updates retain their own source and history.
+Open the detail or linked evidence to understand it; viewing a request is
+not approval or delivery, and closing a queue item is not proof of a
+completed product outcome. Missing or incomplete reads stay visible.
+
+## Preview terminals before opening them
+
+TERMINALS lists saved and derived views with their members and resolved
+layout. A preview is passive. Deliberate Open uses the inspected plan and
+reports opened, absent or degraded members, including partial failures.
+Help and side trips return to the same preview and page. The observed native
+provider journey uses Herdr; broader provider limits are listed below.
+
+CONFIG keeps full values, defaults and source/override provenance readable.
+Help supplies command descriptions, grammar and examples, including during
+startup failures. Narrow views retain scrolling and return controls. Health
+keeps INFO severity separate from Unknown assessment, exposes stale and
+unavailable reads, and explains that an empty findings list is **not a healthy
+verdict**. The complete empty-health explanation is readable at 80 columns.
+
+## Choose oversight for the work in front of you
+
+Human-led work is quiet by default for process-only diagnosis. Explicit
+delegation can enable that oversight during planning as well as execution,
+subject to the existing diagnosis policy and delivery prerequisites. Ordinary
+work reminders and operational health retain their behavior. Scope, phase
+and posture come from explicit sources; unresolved identity stays unknown.
+
+Use `rig mode effective` with an explicit scope to inspect the result.
+The [scoped operating posture reference](../reference/scoped-operating-posture.md)
+describes selection and precedence. A posture preference grants no execution
+authority. Correction records can retain selected current guidance and
+distinguish an assessment, an action actually taken and a later observed
+effect. These are supported mechanics, not evidence of improved judgment:
+natural behavioral effect remains **UNOBSERVED**, and human time cost remains
+**UNMEASURED**. No cure or reduced recurrence is claimed.
+
+## Update context without discarding local authorship
+
+`rig context add <repository-path-or-URL> --git` retains the relationship
+between a Git source, its checkout and a selected context pack. Use `--pack`
+when selecting a pack within a repository. Existing Git credentials apply.
+
+Use `rig context source inspect <ref>` to inspect local changes, conflicts,
+revision and selection without fetching. `rig context source update <ref>`
+explicitly fetches and merges upstream before selecting clean content.
+Committed local work survives an ordinary merge. Dirty work, conflicting
+changes, unavailable upstreams or edits to the served selection cause a
+named refusal rather than a reset or overwrite. Resolve and commit, or abort
+the merge, in the retained checkout before retrying; the prior served
+selection remains available during a conflict. Updates do not push.
+
+Checkout history, selected served bytes and actual agent consumption remain
+different facts. Read the selected bytes with `rig context get <ref>` and
+check the intended consumer. This does not automatically synchronize every
+context library or adopt guidance into running agents.
+
+## Operator notes and validation limits
+
+Root, CLI, daemon and web-UI package versions are 0.5.13. The terminal TUI
+retains its independent 0.1.0 version. Node requirements are unchanged.
+The ordered migration head advances from 079 to
+`080_scoped_operating_posture`, extending the existing mode-binding store
+with scoped human-led/delegated choices while preserving legacy rows.
+Use the supported upgrade and continuity procedure when adoption is
+authorized; preparing this candidate performs no live migration or restart.
+
+Accepted development evidence connects the journey at 140×42 and 80×24,
+including unavailable/Unknown controls, two-project isolation, current-source
+reading, deliberate native terminal opening and Git conflict preservation.
+Those observations retain their original development cuts and attribution.
+Version, release-note and package checks are separate from those journeys;
+they are not a new whole-release usability study.
+
+- Simultaneous default TUI clients can replace one another's programmatic
+  control-socket address. This remains a known, unfixed limitation, judged
+  nonblocking for the demonstrated single-client human journey. Unique test
+  sockets do not prove product-level multi-client isolation; historical lost
+  requests remain unverified.
+- Native terminal proof covers Herdr. SSH login, cmux end-to-end behavior
+  and effects on a parent host remain unverified. Existing native continuity
+  evidence is reused only for unchanged paths, not new provider coverage.
+- A private shutdown timed out while closing connections; clean completion
+  and pending effects remain unverified. Earlier sandbox public-start failures
+  remain recorded failures despite a later successful managed private start.
+- Synthetic findings and requests exercise mechanics, not natural behavioral
+  improvement or real human approval/delivery. No unfamiliar-human study,
+  real-host reboot, all-platform run or live 0.5.13 adoption is established.
+- Final exact-cut verification and publication still require their separate
+  evidence and authorization. These notes do not announce an available npm
+  release or authorize adoption.

docs/releases/v0.5.14.md

@@ -0,0 +1,147 @@
+# OpenRig v0.5.14 — clearer navigation, mission progress and human notifications
+
+OpenRig 0.5.14 makes reading more predictable when opened or refreshed, keeps
+human requests distinct from informational updates, and groups instance settings
+and health where they are easier to find.
+
+## Enter and keep reading
+
+Bare interactive `rig` enters the ordinary TUI after confirming a running rig.
+An instance without running rigs keeps the startup chooser. Help, Skip and Local
+remain responsive during slow or unverified detection; a late observation does
+not take navigation away after the user has chosen another route.
+
+Pages distinguish initial loading, successful empty results, refresh and failure.
+The navigator remains usable through page and rig changes. A previously read page
+can stay visible with its original scope label while the selected page loads;
+that prior content has no action targets. Same-scope refresh retains useful content,
+with the previous read time and Retry. A failed Feed source retains its own data
+while healthy sibling sources update. Confirmed denial, empty results and removals
+clear affected content, and late replies cannot replace the current selection.
+First visits retain navigation and local feedback. Topology first offers rig
+selection, then reads that rig before unrelated fleet details. Terminal names are
+available before detailed readiness and preview.
+
+Projects keeps malformed mission and slice sources visible as local errors while
+healthy neighbors remain readable. Correcting the affected source and refreshing
+restores its content without showing its parser fragment above unrelated work.
+
+Optional blocker descriptions load independently, so an unavailable description
+does not hide primary queue facts or change the recorded human recipient.
+Fleet reads share one elapsed request budget across stages and retain local
+results when a remote source fails. Repeated proof-policy and delivery-receipt
+reads avoid duplicate work while later reads still observe current inputs.
+These changes reduce measured work; they do not establish a latency guarantee.
+
+Selective restore and startup event indexes reduce inventory read work while
+preserving event history and projection results. Private query replay does not
+establish a general live response-time guarantee.
+
+Terminal catalogs reuse one inventory read instead of repeating the same global
+scan. The measured result was equivalent with less query work; this is not a
+general latency guarantee. Existing saved-view discovery, passive preview and
+deliberate Herdr Open remain available.
+
+## Complete requests and quiet updates
+
+Human notifications distinguish explicit decision requests from informational
+updates. A request carries a complete brief and requested action; related
+supplemental detail can continue in its thread. Content that exceeds supported
+limits is refused with an author correction instead of silently losing essential
+text. The shipped authoring guidance calls for concise, complete human briefs.
+
+Informational FYIs require no action or reply and do not create approval
+obligations. Delivery completion is separate from a human decision. Partial or
+ambiguous delivery remains distinguishable, and retry/reply tracking keeps each
+request and its thread separate. Existing callers without an explicit intent
+retain decision behavior.
+
+## Find requests and instance health
+
+The six top-level entries are **Topology, Specs, Projects, Terminals, Feed and
+System**. Feed explicitly covers the instance and all humans. **Human requests**
+shows recipients and relevant scope; **Updates** includes confirmed delivered
+FYIs alongside existing outcome and health updates. Delivered FYIs remain in a
+bounded history after their delivery obligation closes. Reading is not approval.
+Feed's Explorer contains these categories, with entries in the content pane.
+Specs kind groups and Derived terminal views start collapsed and expand explicitly;
+Saved views stay prominent. Saved membership still requires deliberate setup, and
+opening a terminal view remains an explicit action.
+
+System opens to instance **Health**, followed by **Configuration** and
+**Connections**. Contextual Health, global Help and compatible direct commands
+remain available, including `attention`, `needs`, `feed`, `config` and
+`connections`.
+
+## Understand mission progress
+
+Projects puts completed outcomes, current work and owner, blockers, next dependency
+and slice boxes before process prose at both terminal widths. Accepted required
+proof judgments determine slice outcomes; all slice outcomes must be complete
+before the mission reports outcomes complete. Evidence attachments, quiet activity
+and handoff alone do not accept proof. Reopened or assigned unfinished work stays
+open, including when there is no unassigned next slice.
+
+Actual custody and planned ownership remain separate. Authored lifecycle and
+publication are separate from outcome completion; unknown ownership or eligibility
+stays unknown. Narrow screens retain a full first box and scroll for the remainder.
+
+## Operator notes and verification limits
+
+Root, CLI, daemon and web UI versions are 0.5.14; the terminal TUI remains 0.1.0.
+Node requirements are unchanged. Migration 081 adds explicit intent and
+supplemental detail to queue records. The migration head is now
+`084_inventory_event_indexes`, adding three selective inventory read indexes;
+083 adds the two review read indexes. Migration 082 adds nullable identity
+provenance to archived queue transitions. Archival preserves recorded values and
+refuses an archive schema that cannot carry them; legacy unknown values remain null.
+Shared history, RECENT and OWNER/receipt readers now include archived records,
+so their results can broaden even where the command or TUI code is unchanged.
+Migration alone does not reconstruct previously lost metadata. Use the supported
+upgrade and continuity process when adoption is authorized.
+
+The private combined review exercised installed journeys at 140×42 and 80×24,
+including entry, refresh, source failure, scope identity, detail/Back, saved
+terminal Open and notification correlation. An initial Feed source-failure defect
+was retained in the evidence and repaired, then independently rechecked. Owner
+candidate-native evidence and the reviewer's child TUI against an unchanged
+parent daemon remain separate observations.
+
+Later operator inspection exposed disruptive navigation and a misleading mission
+overview. The corrected private combined review covers the new navigation,
+organizers and native mission states. Its false NEXT-completion finding was
+preserved, repaired and independently rechecked at both widths. These private
+results remain limited to the journeys and environments exercised.
+
+VM inspection was accepted on September 14: generally zero-to-two-second
+loading with occasional timeouts, along with formatting, icon colors and default
+views. This observed result is not a general latency or availability guarantee.
+Later recovery of the same candidate preserved sessions but did not establish a
+durable responsiveness fix.
+
+- Intermittent read timeouts remain. An inherited CLI health-check deadline can
+  report the daemon unresponsive before sending a queue request even when the
+  direct request succeeds. That defect is not fixed here; occasional server
+  delay also remains unattributed.
+- Earlier notification checks used controlled HTTP responses and synthetic replies.
+  A later real single-consumer Slack exercise confirmed complete decision/detail/FYI
+  posting and reply correlation; the operator confirmed phone readership and
+  readability. That observation does not establish OS push behavior or all clients.
+- Terminal provider evidence covers disposable Herdr members. Other provider,
+  remote and parent-host behavior is not established by this review.
+- Saved Build watch discovery was exercised in the VM and its native judgment
+  recorded. That observation does not establish general navigation responsiveness.
+- Simultaneous default TUI clients retain the existing programmatic control-socket
+  limitation. Unique test sockets do not prove general multi-client isolation.
+- Version and package checks do not repeat the development journeys or establish
+  a new whole-source, all-platform or unfamiliar-human usability result.
+- Observed shutdown-drain timeouts, recorded config-preservation uncertainties
+  and a prior `recorder_write_failed` observation are not claimed resolved.
+  Recovery evidence remains distinct from ordinary-entry verification and does
+  not establish whole-system health.
+- Historical source-scan findings retain their recorded dispositions; a clean
+  changed-path scan is not a clean whole-source scan.
+- Bundled Workflow Specs, including `basic-loop`, can disappear from discovery
+  after an upgrade changes the install directory despite their YAML remaining
+  intact. The discovery fix is explicitly deferred beyond 0.5.14; this release
+  contains no repair for it.

docs/releases/v0.5.15.md

@@ -0,0 +1,117 @@
+# OpenRig v0.5.15 — first-use recovery, software factory guidance and Pi fixes
+
+Changes for version **0.5.15**. Publication status and date are recorded on the
+[GitHub release](https://github.com/mvschwarz/openrig/releases/tag/v0.5.15) and npm.
+
+OpenRig 0.5.15 improves startup and recovery, adds public guidance for a continuing
+software team and user-chosen command permissions, and fixes Pi reply visibility,
+shell context and terminal input handling.
+
+## Start and return with clearer guidance
+
+Before launching, read
+[what OpenRig changes on your machine](../../README.md#what-openrig-changes-on-your-machine).
+Provider integration can configure executable hooks and workspace trust; changing
+only `OPENRIG_HOME` does not isolate provider configuration. The
+[getting-started guide](../reference/getting-started.md) walks through your first
+task and explains these setup effects.
+
+Check the commands available in your installation:
+
+```sh
+rig --version
+rig --help
+rig up --help
+```
+
+Startup and recovery recognize native Codex through shell and Node launchers,
+and report uncertainty when process identity cannot be established. Recognized
+update notices are skipped without installing provider updates. Authentication
+and trust choices remain yours.
+
+Startup errors now describe the problem and a recovery action. If a name matches
+both a starter and a stopped rig, `rig up <name> --existing` selects the existing
+rig. Inspect its reported state before assigning more work.
+
+## Continue useful reviewed work
+
+Give your agent a real repository, an outcome and the decisions you want to keep.
+The bundled OpenRig Software Factory recipe supports direct team work,
+queue-supported orchestration or an optional explicit Workflow.
+
+```sh
+rig context show skills/core/openrig-software-factory --json
+rig context get skills/core/openrig-software-factory/SKILL.md
+rig context get skills/core/openrig-software-factory/references/worked-example.md
+```
+
+Start with the two-seat team. Add one or two seats with `rig grow` when the work
+benefits from separate responsibilities. The example covers roles, context,
+work ownership, independent review, concurrency and cost, and distinguishes
+changes to the running team from saving an updated RigSpec. Use guidance matching
+your installed version.
+
+## Choose command permissions
+
+Ask your agent to inspect the target harness, explain the available scopes and
+apply your choice while preserving existing rules:
+
+```sh
+rig context get skills/applying-a-permission-policy/SKILL.md
+```
+
+Allowing the whole `rig` command family includes lifecycle and configuration
+changes as well as reads. Choose narrower commands or retain approval prompts
+when appropriate. Project-only setup requires supported, active and trusted
+project configuration; if it is unavailable, the agent should explain the limit
+instead of substituting user-wide permission. Back up touched files and verify
+the selected rules in the actual conversation. Shipped sandbox, approval and
+permission defaults are unchanged.
+
+## Known compatibility limitation
+
+On macOS arm64 with Node 24, installing the SQLite dependency can fail when a
+suitable prebuilt binary is unavailable and compilation is not available.
+Compiler-built SQLite has also failed during database cleanup at runtime.
+**Use Node 22 on macOS arm64 for now.** This recommendation does not change the
+declared Node support range, and this version does not update SQLite.
+
+## Pi replies, input and recovery
+
+Pi replies and tool progress are visible for the supported RPC event shapes.
+Shell tools retain the managed OpenRig context needed for identity and routing.
+Provider errors are shown with bounded text, and exhausted retries do not print
+the same error repeatedly.
+
+Pasted messages wait for explicit submission. The terminal runner accepts input
+beyond the terminal's canonical buffer limit, preserves editing and cancellation,
+and recovers after rejecting an oversized framed message. This is not a general
+latency guarantee or an unrestricted input-size promise.
+
+An added seat whose first startup failed during resource projection, before its
+startup context was saved, can use the guarded retry after the setup problem is corrected.
+Retain the complete original member fragment and its source root; a snapshot alone
+does not reconstruct missing startup configuration. Use one retry at a time.
+Ordinary conversation resume remains separate.
+
+**Pi support is qualified and supervised.** Controlled coding, follow-up,
+reporting and conversation continuity were verified with Pi 0.87.1 and OpenRouter
+`z-ai/glm-5.3-flash`; ordinary-seat identity, tools and a reply also worked.
+Completion of an ordinary useful task and unattended team operation remain
+unverified. Context-profile selection and hook-generation coverage are limited;
+do not assume parity with every Codex or Claude integration. The Software Factory
+guide likewise does not establish fully unattended operation.
+
+## Contributors and included pull requests
+
+Thanks to [@danielkuykendall23-boop](https://github.com/danielkuykendall23-boop)
+for the Pi reply fix in [#37](https://github.com/mvschwarz/openrig/pull/37), and to
+[@mvschwarz](https://github.com/mvschwarz) for Codex startup and restore guidance
+([#38](https://github.com/mvschwarz/openrig/pull/38)), Software Factory and permission
+guidance ([#39](https://github.com/mvschwarz/openrig/pull/39)), contribution and
+support guidance ([#45](https://github.com/mvschwarz/openrig/pull/45)), and the
+first-use README ([#46](https://github.com/mvschwarz/openrig/pull/46)).
+
+This release also includes the startup-identity refinements, guarded first-start
+retry, Pi shell/error handling and terminal-input fixes described above. Project
+work-policy features and the Node 22/SQLite 13 upgrade are outside this release.

docs/releases/v0.5.16.md

@@ -0,0 +1,62 @@
+# OpenRig v0.5.16 — choose the Claude instruction file
+
+Changes for version **0.5.16**. Publication status and date are recorded on the
+[GitHub release](https://github.com/mvschwarz/openrig/releases/tag/v0.5.16) and npm.
+
+OpenRig 0.5.16 lets a rig keep its managed Claude Code instructions out of a
+tracked `CLAUDE.md`, and adds an advisory portability report for pull requests.
+
+## Keep a tracked CLAUDE.md unchanged
+
+OpenRig writes its instructions for Claude Code members into managed blocks in
+each member's working directory. By default that file is `CLAUDE.md`. If your
+repository tracks `CLAUDE.md`, select `CLAUDE.local.md` in the rig spec:
+
+```yaml
+managed_blocks:
+  claude-code: CLAUDE.local.md
+```
+
+Claude Code loads `CLAUDE.local.md` from the working directory as well; keep it
+out of git, for example with a `.gitignore` entry. The selection applies when
+members launch, restore, relaunch or are added, and it is kept by `rig export`
+and rig bundles. `rig down` removes OpenRig's blocks only from the selected file.
+OpenRig never edits, moves or deletes blocks in the other file.
+
+Only the `claude-code` key is accepted, with `CLAUDE.md` or `CLAUDE.local.md`;
+any other key or value is rejected before a member launches. Without the field,
+behavior is unchanged. Codex members always use `AGENTS.md`.
+
+**Switching an existing rig:** blocks OpenRig already wrote into `CLAUDE.md`
+stay there. Until you remove them, the file stays modified and Claude Code loads
+both copies. Delete each `<!-- BEGIN OpenRig MANAGED BLOCK: … -->` …
+`<!-- END OpenRig MANAGED BLOCK: … -->` section by hand and keep the rest of the
+file. If `CLAUDE.md` has no other uncommitted edits you need to keep, you can
+instead run `git restore CLAUDE.md`; that command discards every unstaged change
+to the file, not only OpenRig's blocks. See
+[the RigSpec reference](../reference/rig-spec.md#choosing-the-claude-instruction-file).
+
+## Portability report for pull requests
+
+A new pull-request workflow lists added lines that contain values tied to one
+machine, network or account: credentials, home and temporary paths, network
+addresses and email addresses. Suspected credentials are withheld from the
+report. Findings never fail the check; the author decides what to change. It is
+pattern-based and does not guarantee that nothing private remains. Run it
+locally with:
+
+```sh
+node scripts/portability-report.mjs
+```
+
+## Contributors and included pull requests
+
+Thanks to [@hvpaiva](https://github.com/hvpaiva) for reporting and proposing the
+Claude instruction-file option in [#25](https://github.com/mvschwarz/openrig/issues/25),
+and to [@mvschwarz](https://github.com/mvschwarz) for the README badges and demo
+([#54](https://github.com/mvschwarz/openrig/pull/54)) and the portability report
+([#56](https://github.com/mvschwarz/openrig/pull/56)).
+
+The Node support range and SQLite version are unchanged. The macOS arm64 with
+Node 24 SQLite installation limitation noted for 0.5.15 still applies; use
+Node 22 on macOS arm64.

docs/releases/v0.5.17.md

@@ -0,0 +1,35 @@
+# OpenRig v0.5.17 — install with Bun
+
+Changes for version **0.5.17**. Publication status and date are recorded on the
+[GitHub release](https://github.com/mvschwarz/openrig/releases/tag/v0.5.17) and npm.
+
+OpenRig 0.5.17 can be installed with Bun as well as npm.
+
+## Install with Bun
+
+```sh
+bun add -g @openrig/cli
+```
+
+Earlier versions listed the unpublished `@openrig/daemon` package as a dependency.
+npm used the copy bundled in the package, but Bun looked it up in the registry
+and failed with a 404. The package now imports the daemon copy it already ships
+and no longer depends on `@openrig/daemon`, which also makes it smaller. npm
+installation is unchanged.
+
+OpenRig still runs on Node.js, so install Node.js 22 as well. Bun may block this
+package's postinstall script. In that case the Node.js version and SQLite check
+does not run at install time. See [what OpenRig changes on your machine](../../README.md#what-openrig-changes-on-your-machine).
+
+The installation fix was verified with Bun 1.4.0 and npm on macOS arm64 with
+Node.js 22. Other combinations are not verified.
+
+## Contributors and included pull requests
+
+Thanks to [@drewpayment](https://github.com/drewpayment) for reporting the Bun
+installation failure in [#66](https://github.com/mvschwarz/openrig/issues/66),
+fixed in [#68](https://github.com/mvschwarz/openrig/pull/68).
+
+The Node support range and SQLite version are unchanged. The macOS arm64 with
+Node 24 SQLite installation limitation noted for 0.5.15 still applies; use
+Node 22 on macOS arm64.

docs/releases/v0.6.0.md

@@ -0,0 +1,213 @@
+# OpenRig v0.6.0 — works for strangers
+
+Changes for version **0.6.0**. Publication status and date are recorded on the
+[GitHub release](https://github.com/mvschwarz/openrig/releases/tag/v0.6.0) and npm.
+
+OpenRig 0.6.0 requires Node.js 22 or 24. It adds per-seat permission choices, a
+per-seat typing guard for seats where you type by hand, and a one-step way to open
+a whole rig in Herdr. It fixes Pi seat activity and clarifies the kernel starter's
+runtime choice.
+
+It also includes two **experimental** features: Slack app manifest and setup
+assistance, and an optional stream classifier (Jev with Rig Stream) that is off by
+default. They may be incomplete or not work in your setup. See
+[Report experimental problems](#report-experimental-problems).
+
+## Breaking change: Node.js 22 or 24
+
+OpenRig 0.6.0 supports Node.js 22 and 24 only, and uses better-sqlite3 13, which
+requires Node 22 or newer. Node 20 is no longer supported: the install check
+refuses it with an explanation. Node 26 and other versions are untested.
+
+If you run OpenRig on Node 20, switch Node first, then reinstall the CLI under
+the new Node. Your existing data stays where it is; the daemon reopens the same
+database and applies pending migrations in place. See
+[Moving off Node 20](../../README.md#moving-off-node-20).
+
+OpenRig runs on macOS or Linux. Native Windows is not supported yet, and WSL2
+has not been tested. On a Mac with Apple silicon, use Node.js 22 (see the
+[compatibility history](v0.5.15.md#known-compatibility-limitation)).
+
+## Choose permissions per seat
+
+`rig seat set-permissions <seat> --mode <mode> --reason <text>` records an audited
+permission choice for a seat's future launches: `floor`, `full_bypass`, or
+`inherit` to clear the override. Codex `full_bypass` now passes
+`-s danger-full-access -a never`, so it bypasses approvals as well as the
+sandbox. Additional Claude Code modes such as `auto` are accepted only when the
+seat's managed Claude executable advertises them; OpenRig checks this at
+selection and again at launch, and refuses without a fallback.
+
+The choice does not relaunch the seat or change its current process, history,
+rules or hooks. `rig seat status` shows the selected mode and the last launch
+arguments; neither proves the native permission behavior, so check the running
+session before relying on it. Rig-level policy moves to
+`rig policy permissions list|show|current|apply`; the old `rig policy` verbs
+remain as aliases. See the [permission guide](../reference/getting-started.md#per-seat-permission-mode).
+
+## Protect a seat where you type by hand
+
+`rig seat set-typing-guard <seat> --enabled true --reason <text>` pauses all
+automatic terminal input to that seat, even at an empty prompt. Messages and
+wakes are kept in the outbox instead of being typed in; read them with
+`rig seat held-messages <seat>` and retire reviewed ones with
+`rig seat retire-held-message <seat> <id> --reason <text>`. Turning the guard off
+allows new sends; it never replays held messages.
+
+The guard is off by default, and other seats keep automatic delivery. Wait for
+`rig seat status <seat>` to report it as effective before relying on it. It covers
+OpenRig's own input paths, not other tools writing directly to the terminal.
+`rig seat set-typing-guard --help` lists the retention limits.
+
+## Experimental: Slack app manifest and setup assistance
+
+`rig slack manifest` prints the Slack app manifest for the app you create in your
+own workspace. It runs offline, before any daemon or token exists; `--url`
+prints Slack's create-app link with the manifest prefilled, and `--json` lists
+each requested scope with its reason. The TUI Connections page shows the same
+link while Slack is not configured. OpenRig does not host an app, open a
+browser or accept tokens here.
+
+This manifest and the [Slack setup guide](../reference/slack-app-setup.md) are
+experimental. The guide's creation steps follow Slack's manifest documentation
+and have not been confirmed against a real app creation: we have not observed
+which fields Slack prefills or a complete set of granted scopes. You still
+create the tokens and the private env file by hand. The existing Slack connector
+and its `rig slack setup`, `verify`, `enable`, `disable` and `status` commands are
+not experimental; `setup` and `status` now also point you to the manifest.
+`rig slack verify` checks only the baseline scopes, so a READY result does not
+prove attachments or mentions work.
+
+## Open a whole rig in Herdr
+
+In the TUI, a rig's detail view has a `term ▸ rig <name>` link, and the command
+bar accepts `terminal <view>`. With Herdr, every running seat of the rig opens in
+a workspace named after the rig, up to 16 seats per tab (cmux keeps its own
+limits). The empty starting tab is closed only when OpenRig can confirm the rig's
+own tabs opened; otherwise it is kept, and the result says so. Seats that are not
+running are reported as absent or degraded rather than opened.
+
+## First-use and compatibility fixes
+
+- Pi seat activity reports now carry the seat's occupant generation, and the
+  daemon accepts them only when that generation matches the seat's current
+  occupant. Reports with a missing, earlier or foreign generation are refused
+  instead of being attributed to the seat.
+- The kernel starter's summary now says when it shows the library preview,
+  explains that the runtime variant is chosen automatically, and points to the
+  seats actually running.
+- Codex seats launch with `--no-daemon` when the installed Codex supports it, so
+  each seat's tools run in its own app-server instead of a shared daemon. OpenRig
+  checks support before each launch and refuses the launch if the check fails.
+- Missions and slices created with `rig scope` no longer fail the readiness
+  reader when their manifest has no `metadata` block.
+- Choosing `CLAUDE.local.md` for Claude Code managed blocks, added in 0.5.16, is
+  included unchanged.
+
+## Experimental: stream classification (Jev with Rig Stream)
+
+OpenRig 0.6.0 includes an optional, experimental way for a classifier seat to
+have Jev, through OpenRouter, label Rig Stream observations. It may be incomplete
+or not work. It is off by default; turn it on for a local configuration file:
+
+```sh
+rig project experimental status --config ./experiment.json --json
+rig project experimental enable --config ./experiment.json --max-requests 3 --timeout-ms 10000 --json
+rig project experimental disable --config ./experiment.json --json
+```
+
+Enabling starts no processing, capture, daemon or agent. Work happens only when
+the classifier seat runs one foreground command, `rig project wake … --experiment
+./experiment.json`, which allows 1–20 requests (default 3) and never retries in
+the background. The run needs `OPENROUTER_API_KEY` in that process's environment
+and sends the selected items' text, the taxonomy questions, scope IDs and roster
+destinations to OpenRouter. Disable stops further calls and discards late
+results; Ctrl-C cancels the run, though a request already forwarded may still be
+charged.
+
+The labels are advisory. They have no demonstrated accuracy or calibrated
+confidence, and this release adds no delivery, watchdog or routing consumer for
+them. `rig project experimental capture` applies the same client to an existing
+shadow-capture archive, and `rig project shadow-status`, `shadow-drain` and
+`shadow-stop` manage capture, which needs its own separately configured daemon
+start; `rig project shadow-stop` stops it. See
+[stream classification](../reference/stream-classifier-worker.md) for the taxonomy
+format, request limits and error handling.
+
+## Report experimental problems
+
+If the Slack manifest, the setup guide or the stream classifier does not work as
+described, please [open an issue](https://github.com/mvschwarz/openrig/issues/new/choose)
+with the bug template, or send a pull request following
+[CONTRIBUTING.md](../../CONTRIBUTING.md). A problem with the existing Slack
+connector or any other existing feature is a regular bug report.
+
+## Known limitations
+
+- Per-seat permissions: authenticated native enforcement across fresh launch,
+  resume and same-seat fork was not verified before release. Status output and
+  launch arguments do not prove a selected mode's effective permissions; inspect
+  the running session.
+- Slack manifest and setup assistance (experimental): creating the app in a real
+  workspace, Slack's prefilled fields and the complete granted scopes have not
+  been observed against the published steps.
+- Herdr: check that the rig opened as expected in your Herdr version.
+- Pi: activity reporting from an installed Pi seat has not been verified end to end.
+- Stream classification (experimental): an installed run and real OpenRouter
+  access have not been verified, and its output may be incomplete or wrong. No
+  accuracy or production-reliability claim is made.
+- The Codex hook-trust dialog report in [#17](https://github.com/mvschwarz/openrig/issues/17)
+  has not been reproduced, and this release does not change it.
+- Node 26 and odd-numbered Node versions are not supported or tested.
+
+## Verification scope
+
+Release preparation is tracked in [#109](https://github.com/mvschwarz/openrig/pull/109).
+An ordinary candidate-tarball installation passed on a fresh macOS 15.7.3 ARM64
+VM with Node.js 22.22.1 and the real npm postinstall. Checks covered
+better-sqlite3 13.0.3, all 89 migrations, database writes and close/reopen, and
+normal unauthenticated daemon startup and shutdown.
+
+Prior candidate checks on Node 24 covered installed SQLite, migrations and
+allocation-driven garbage collection. The relevant install and database
+mechanisms are unchanged. That installation used a staged offline postinstall;
+it was not a fresh-machine install. A fresh Node 24 VM installation was not
+performed because of host resource pressure.
+
+These checks do not establish an authenticated first-agent launch, a fresh
+Linux or Windows installation, installation without compiler tools, or an
+installation downloaded from the npm registry. The final artifact will be
+separately bound to the merged release commit.
+
+## Contributors and included pull requests
+
+Thanks to:
+
+- [@jimallen](https://github.com/jimallen) for reporting the Node 26 installation
+  failure and proposing the better-sqlite3 13 upgrade in
+  [#16](https://github.com/mvschwarz/openrig/pull/16).
+- [@shravansumanthanan](https://github.com/shravansumanthanan) for the mission
+  readiness fix in [#91](https://github.com/mvschwarz/openrig/pull/91), and
+  [@kainne44](https://github.com/kainne44) for reporting it in
+  [#72](https://github.com/mvschwarz/openrig/issues/72).
+- [@mvdpoel](https://github.com/mvdpoel) for repairing two daemon test fixtures in
+  [#84](https://github.com/mvschwarz/openrig/pull/84).
+- [@reisalbuquerque](https://github.com/reisalbuquerque) for reporting the shared
+  Codex app-server identity problem in
+  [#69](https://github.com/mvschwarz/openrig/issues/69), fixed in
+  [#77](https://github.com/mvschwarz/openrig/pull/77).
+- [@DoowanKang](https://github.com/DoowanKang) for
+  [#29](https://github.com/mvschwarz/openrig/issues/29) and
+  [#30](https://github.com/mvschwarz/openrig/issues/30),
+  [@djogss](https://github.com/djogss) for
+  [#33](https://github.com/mvschwarz/openrig/issues/33),
+  [@some-marketing](https://github.com/some-marketing) for
+  [#48](https://github.com/mvschwarz/openrig/issues/48),
+  [@shintaii](https://github.com/shintaii) for
+  [#26](https://github.com/mvschwarz/openrig/issues/26) and
+  [@tgrundtvig](https://github.com/tgrundtvig) for
+  [#21](https://github.com/mvschwarz/openrig/issues/21).
+
+The platform statement in [#94](https://github.com/mvschwarz/openrig/pull/94)
+answers the Windows question in [#88](https://github.com/mvschwarz/openrig/issues/88);
+native Windows support is not part of this release.

docs/releases/v0.6.1.md

@@ -0,0 +1,107 @@
+# OpenRig 0.6.1 — First-use repairs and one help path
+
+OpenRig 0.6.1 improves first-use guidance, Codex readiness and linked-worktree
+launches, with a single help path and regression checks on pull requests.
+
+## Find help from the installed version
+
+Ask your agent to read:
+
+```sh
+rig context get help
+```
+
+The [help guide](../reference/help.md) brings together environment checks,
+setup and restart symptoms, permissions, instance layout and escalation. Its
+linked reference guides are included with the package too. If OpenRig cannot
+install or `rig` cannot run, use the guide online at
+[openrig.dev/help/agents](https://www.openrig.dev/help/agents), or read
+`daemon/docs/reference/help.md` inside the installed `@openrig/cli` package.
+For help, email **[email protected]**; a GitHub account is not required.
+
+This is the canonical guide added in
+[#113](https://github.com/mvschwarz/openrig/pull/113), with entry points from the
+README and agent startup guidance.
+
+## Read a catalogued project's execution view
+
+```sh
+rig view show execution --project <catalog-id> --mission <mission> --json
+```
+
+The CLI now forwards the selected project and mission to the existing daemon
+resolver, which uses that project's configured missions root. Previously the
+CLI could only use the default workspace for this view. Omitting `--project`
+keeps the existing behavior. This does not add project inference from the
+current directory. Thanks to [@dajiaohuang](https://github.com/dajiaohuang) for
+[#105](https://github.com/mvschwarz/openrig/pull/105).
+
+## Codex readiness and bundled guidance
+
+- Startup/resume checks recognize Codex's `»` conversation prompt, including a
+  fresh prompt after a dismissed hook-review panel. Numbered selection menus
+  still require attention. Thanks to
+  [@dajiaohuang](https://github.com/dajiaohuang) for
+  [#111](https://github.com/mvschwarz/openrig/pull/111).
+- The bundled Vault skill has valid frontmatter, with a regression check for
+  shipped skill headers ([#115](https://github.com/mvschwarz/openrig/pull/115)).
+- Historical development evidence has been removed from the public source tree
+  ([#118](https://github.com/mvschwarz/openrig/pull/118)). The retired
+  `spike/tui-drivability` prototype was also removed
+  ([#119](https://github.com/mvschwarz/openrig/pull/119)); the shipped TUI remains.
+
+## Identity readings and Codex launches
+
+- **Boot-time comparisons on non-UTC hosts:** parse SQLite's zone-less boot
+  timestamp as UTC. Identity and context-usage readers then compare observations
+  with the actual generation start, avoiding time-zone shifts that could reject
+  current observations or accept older ones. Thanks to
+  [@Coder8124](https://github.com/Coder8124) for
+  [#124](https://github.com/mvschwarz/openrig/pull/124).
+- **Custom Codex status lines:** recognize an interactive conversation when its
+  header has scrolled away and the status line puts a mixed-case model name
+  after other fields. Unresolved trust, hook, update and model-selection gates
+  remain in place. This is recognition only; the separate stale restore-warning
+  behavior from [#116](https://github.com/mvschwarz/openrig/issues/116) is not
+  repaired here. Thanks to [@Hexgunner69](https://github.com/Hexgunner69) for the
+  report and [@Aummadour](https://github.com/Aummadour) for screen-derived
+  regression cases included in [#125](https://github.com/mvschwarz/openrig/pull/125).
+- **Linked Git worktrees:** Codex fresh launches resolve the worktree's Git
+  directory and common Git directory instead of treating its `.git` file as a
+  directory. Resume/fork arguments and permission modes are unchanged. Thanks to
+  [@mgall-ibizdigital](https://github.com/mgall-ibizdigital) for the report,
+  reproduction and suggested approach in
+  [#121](https://github.com/mvschwarz/openrig/issues/121), addressed by
+  [#126](https://github.com/mvschwarz/openrig/pull/126).
+
+## Regression checks on pull requests
+
+[#117](https://github.com/mvschwarz/openrig/pull/117) adds eight test jobs: build
+and package-file inspection, type checking, repository checks, four separate
+daemon/CLI/TUI/UI suites, and an installed queue-durability scenario. The latter
+checks a normal run, an intentionally introduced lost-baton failure and a
+healthy return. A checker that misses that seeded failure cannot pass.
+
+The workflow uses Node 22, Linux runners for the build/repository/installed
+scenario jobs, and macOS runners for the four package suites. It does not run
+all eleven historical scenario seeds or certify every platform, provider or
+authenticated native-agent workflow.
+
+## Upgrade and compatibility
+
+Node.js 22 and 24 remain the supported versions; Node 20 is unsupported. No
+dependency, engine, permission-mode or database-migration change is introduced
+by this maintenance release. Follow the existing
+[upgrade procedure](../../skills/_canonical/core/openrig-upgrade/SKILL.md)
+when updating an existing instance.
+
+Package identities and the checks performed on each published artifact belong
+with its [GitHub release](https://github.com/mvschwarz/openrig/releases). These
+source notes do not certify every platform or authenticated native workflow.
+Native permission enforcement across fresh launch, resume and fork retains
+the verification limits recorded for 0.6.0.
+
+Slack app manifest/setup assistance and Rig Stream classification remain
+**experimental**. This release makes no new real-app, provider-run, accuracy or
+reliability claim for them. The existing Slack connector is not experimental.
+See the [0.6.0 limitations](v0.6.0.md#known-limitations) for retained boundaries.

docs/releases/v0.6.2.md

@@ -0,0 +1,114 @@
+# OpenRig 0.6.2 — Start with the team you already have accounts for
+
+Choose your providers, give an owner one useful change in your repository, and
+have a second agent check the result. OpenRig 0.6.2 adds first-project choices,
+clearer permission guidance and repairs for bundle installation and agent delivery.
+
+## A small team and one useful result
+
+The [first-use guide](../reference/getting-started.md) offers the same owner and
+checker workflow with three recipes:
+
+| Team | Recipe |
+| --- | --- |
+| Two Codex agents | `first-project` |
+| Two Claude Code agents | `first-project-claude` |
+| Claude owner and Codex checker | `first-project-mixed` |
+
+Use the accounts you already have; an unused provider's installation or login is
+not a prerequisite. Codex seats retain `gpt-6-astra`; Claude seats use the native
+configured default. Check model access before launching. Automatic kernel startup
+continues to select independently from available authenticated providers.
+
+Agent-guided setup asks once whether to allow OpenRig commands without repeated
+permission prompts, with **Yes recommended**. An explicit Yes authorizes native
+`rig` command rules at personal project scope unless you choose user-wide scope.
+No or no answer leaves settings unchanged. The allowance includes lifecycle and
+configuration commands, but does not grant general shell access or change sandbox
+and network settings. The guide covers applying, checking and undoing the rules;
+bootstrap does not silently apply them
+([#147](https://github.com/mvschwarz/openrig/pull/147)).
+
+## Bundle files stay where you install them
+
+Schema-version-2 bundles now copy their verified contents into `--target` and
+launch from there, keeping relative working directories and agent references
+available after temporary extraction is removed. Different files at a bundle
+path cause `target_conflict` before copying; identical files can be reused.
+
+Without `--target`, `rig up <file>.rigbundle` installs into your current directory, so run it from the project folder you want.
+
+`rig bundle create|inspect|install` and local `rig up --target` resolve relative
+paths against your current directory. Files still live on the daemon's host;
+this is not an upload. Install launches the rig. Legacy version-1 behavior and
+the separate `--cwd` override are unchanged. See the
+[bundle guide](../reference/rig-bundle.md#cli-surface)
+([#146](https://github.com/mvschwarz/openrig/pull/146)).
+
+## Delivery and restore diagnostics
+
+Managed launches after a tmux/host restart preserve the named launch target
+instead of confusing it with an old bare pane binding. The existing identity
+checks still apply to each write. Thanks to
+[@diaztunjano](https://github.com/diaztunjano) for reporting
+[#141](https://github.com/mvschwarz/openrig/issues/141), addressed by
+[#151](https://github.com/mvschwarz/openrig/pull/151). Actual reboot and power-loss
+recovery remain subject to the verification limits below.
+
+Message delivery now refuses a known bare-shell foreground when an agent runtime
+should be running, so the message is not entered as shell commands. Terminal-only
+seats still receive text; unreadable or unknown foregrounds retain the existing
+advisory behavior ([#150](https://github.com/mvschwarz/openrig/pull/150), fixes
+[#142](https://github.com/mvschwarz/openrig/issues/142)).
+
+## Community fixes
+
+- **Local sender identity:** recognize a sender qualified with this daemon's own
+  host ID as its local seat, avoiding false ownership refusals. Foreign host
+  qualifiers and destination handling stay unchanged. Thanks to
+  [@korallis](https://github.com/korallis) for
+  [#135](https://github.com/mvschwarz/openrig/pull/135), and
+  [@Yi-111-a](https://github.com/Yi-111-a) for the additional cases from
+  [#137](https://github.com/mvschwarz/openrig/pull/137), included through
+  [#144](https://github.com/mvschwarz/openrig/pull/144).
+- **Terminal and status details:** parse tmux window fields with printable
+  separators ([#101](https://github.com/mvschwarz/openrig/pull/101)); distinguish
+  health that was not requested from a failed read
+  ([#102](https://github.com/mvschwarz/openrig/pull/102)); use native realpath for
+  Codex hook trust ([#103](https://github.com/mvschwarz/openrig/pull/103)); pass
+  known Claude/Codex runtime hints to Herdr
+  ([#106](https://github.com/mvschwarz/openrig/pull/106)); report missing fresh
+  startup context or adapters as needing attention
+  ([#107](https://github.com/mvschwarz/openrig/pull/107)); accept numeric Claude
+  rate-limit reset timestamps ([#108](https://github.com/mvschwarz/openrig/pull/108)).
+  Thanks to [@dajiaohuang](https://github.com/dajiaohuang).
+- **Pi input and portable checks:** retain line editing with `TERM=dumb`, and
+  correct macOS path and timezone assumptions in tests. Thanks to
+  [@shravansumanthanan](https://github.com/shravansumanthanan) for
+  [#123](https://github.com/mvschwarz/openrig/pull/123).
+- **Configured restore paths:** restore-check uses the configured shared-docs
+  root. This does not repair every issue in
+  [#130](https://github.com/mvschwarz/openrig/issues/130). Thanks to
+  [@jbaehova](https://github.com/jbaehova) for
+  [#139](https://github.com/mvschwarz/openrig/pull/139).
+- **Anthropic gateways:** permit `ANTHROPIC_BASE_URL` in configured provider-auth
+  environment forwarding. Thanks to [@FenjuFu](https://github.com/FenjuFu) for
+  [#143](https://github.com/mvschwarz/openrig/pull/143).
+- **Terminal authentication maintenance:** reuse the shared token-comparison
+  helper. Thanks to [@Sunil56224972](https://github.com/Sunil56224972) for
+  [#145](https://github.com/mvschwarz/openrig/pull/145).
+
+## Upgrade and verification limits
+
+Node.js 22 and 24 remain supported; Node 20 is unsupported. This maintenance
+change adds no dependency, engine or database-migration change. Follow the
+[existing upgrade procedure](../../skills/_canonical/core/openrig-upgrade/SKILL.md).
+
+Installed first-use and reboot/power-loss verification remain pending. Source
+and regression checks do not establish native permission enforcement or recovery
+of an authenticated team after a reboot.
+
+Slack app manifest/setup assistance and Rig Stream classification remain
+experimental, with no new real-app or provider-run validation here. The existing
+Slack connector is not experimental. See the
+[retained limitations](v0.6.0.md#known-limitations).

docs/releases/v0.6.3.md

@@ -0,0 +1,62 @@
+# OpenRig 0.6.3 — Managed Claude messaging repair
+
+This patch repairs a 0.6.2 regression that refused messages to running Claude
+Code seats launched with an explicit permission mode. It also fixes snapshot
+helper cleanup and interference from archived rigs with duplicate names.
+
+## Managed Claude seats can receive messages
+
+OpenRig's managed launch can leave a shell wrapper in front of Claude Code.
+The delivery check previously treated that wrapper as a bare shell and refused
+`rig send`, even though Claude was running beneath it.
+
+The check now recognizes a stable, foreground Claude process descended from the
+bound pane, with the expected native session identity. A bare shell alone still
+does not qualify. Fork arguments that identify the parent rather than the
+current occupant remain insufficient evidence.
+
+Thanks to [@dmelo](https://github.com/dmelo) for the detailed
+[#197 report](https://github.com/mvschwarz/openrig/issues/197), addressed by
+[#220](https://github.com/mvschwarz/openrig/pull/220).
+
+## Snapshot helpers and archived rigs
+
+- Clean up a newly created snapshot helper when its input target cannot be
+  established and its ownership can still be proven. This prevents unusable
+  `rigged-refresh-*` helpers accumulating on repeated attempts. If ownership
+  cannot be established, preserve the session and report the limitation.
+  Thanks to [@z4cc](https://github.com/z4cc) for
+  [#188](https://github.com/mvschwarz/openrig/issues/188), addressed by
+  [#189](https://github.com/mvschwarz/openrig/pull/189).
+- Exclude archived rigs from seat-reference resolution, prefer unarchived
+  delivery targets, and preserve another live seat's session and queue work
+  when removing a stale duplicate node. Removal reports whose session it kept.
+  Thanks to [@Farkinell](https://github.com/Farkinell) for
+  [#174](https://github.com/mvschwarz/openrig/issues/174), addressed by
+  [#181](https://github.com/mvschwarz/openrig/pull/181).
+
+## Proof media and repository checks
+
+`rig proof add` rejects binary files supplied as artifact text, requires a
+Markdown artifact name, and requires `--replace` before overwriting an existing
+artifact. Attach screenshots and other binary evidence with `--media`. This
+prevents a proof write from replacing media with a Markdown body
+([#177](https://github.com/mvschwarz/openrig/pull/177)).
+
+Repository script tests now run serially because packaging tests rebuild daemon
+output that other tests import. This removes the reproduced shared-output race
+without weakening those tests
+([#221](https://github.com/mvschwarz/openrig/pull/221)).
+
+## Upgrade and verification scope
+
+Node.js 22 and 24 remain supported. This patch changes no dependencies, engine
+requirements or database migrations. Use the
+[existing upgrade procedure](../../skills/_canonical/core/openrig-upgrade/SKILL.md).
+
+The fixes have source reviews and focused regression coverage. The Claude
+process checks use synthetic process metadata; an installed Claude/Fedora send
+has not been demonstrated by that evidence. These checks do not establish
+native receipt, automatic recovery, or protection against a process exiting
+between verification and input. Final package and publication verification
+remain separate from this source preparation.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "openrig",
-  "version": "0.5.9",
+  "version": "0.6.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openrig",
-      "version": "0.5.9",
+      "version": "0.6.3",
       "license": "Apache-2.0",
       "workspaces": [
         "packages/daemon",
@@ -15,7 +15,7 @@
         "packages/tui"
       ],
       "engines": {
-        "node": "^20 || ^22 || ^24"
+        "node": "^22 || ^24"
       }
     },
     "node_modules/@adobe/css-tools": {
@@ -2970,26 +2970,6 @@
         "postcss": "^8.1.0"
       }
     },
-    "node_modules/base64-js": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/baseline-browser-mapping": {
       "version": "2.10.10",
       "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.10.tgz",
@@ -3003,14 +2983,15 @@
       }
     },
     "node_modules/better-sqlite3": {
-      "version": "11.10.0",
-      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-11.10.0.tgz",
-      "integrity": "sha512-EwhOpyXiOEL/lKzHz9AW1msWFNzGc/z+LzeB3/jnFJpxu+th2yqvzsSWas1v9jgs9+xiXJcD5A8CJxAG2TaghQ==",
-      "hasInstallScript": true,
+      "version": "13.0.3",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-13.0.3.tgz",
+      "integrity": "sha512-RbOBxmLBG8uvFUc15X9+9SFemKcQ0WBuISBVkpuiaUB2qblC8UWlHEjdWVoZ8AdhSwmoEgsiXKfopX0CQxaACQ==",
       "license": "MIT",
       "dependencies": {
-        "bindings": "^1.5.0",
-        "prebuild-install": "^7.1.1"
+        "node-addon-api": "^8.0.0"
+      },
+      "engines": {
+        "node": ">=22"
       }
     },
     "node_modules/binary-extensions": {
@@ -3025,26 +3006,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/bindings": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
-      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
-      "license": "MIT",
-      "dependencies": {
-        "file-uri-to-path": "1.0.0"
-      }
-    },
-    "node_modules/bl": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
-      "license": "MIT",
-      "dependencies": {
-        "buffer": "^5.5.0",
-        "inherits": "^2.0.4",
-        "readable-stream": "^3.4.0"
-      }
-    },
     "node_modules/body-parser": {
       "version": "2.2.2",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
@@ -3130,30 +3091,6 @@
         "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
       }
     },
-    "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
-      }
-    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -3294,12 +3231,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/chownr": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
-      "license": "ISC"
-    },
     "node_modules/class-variance-authority": {
       "version": "0.7.1",
       "resolved": "https://registry.npmjs.org/class-variance-authority/-/class-variance-authority-0.7.1.tgz",
@@ -3613,21 +3544,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/decompress-response": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
-      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
-      "license": "MIT",
-      "dependencies": {
-        "mimic-response": "^3.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/deep-eql": {
       "version": "5.0.2",
       "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-5.0.2.tgz",
@@ -3638,15 +3554,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/deep-extend": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
-      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
     "node_modules/depd": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
@@ -3666,15 +3573,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/detect-node-es": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/detect-node-es/-/detect-node-es-1.1.0.tgz",
@@ -3736,15 +3634,6 @@
         "node": ">= 0.8"
       }
     },
-    "node_modules/end-of-stream": {
-      "version": "1.4.5",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
-      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
-      "license": "MIT",
-      "dependencies": {
-        "once": "^1.4.0"
-      }
-    },
     "node_modules/entities": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
@@ -3892,15 +3781,6 @@
         "node": ">=18.0.0"
       }
     },
-    "node_modules/expand-template": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
-      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
-      "license": "(MIT OR WTFPL)",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/expect-type": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
@@ -4048,12 +3928,6 @@
         }
       }
     },
-    "node_modules/file-uri-to-path": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
-      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
-      "license": "MIT"
-    },
     "node_modules/fill-range": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -4118,12 +3992,6 @@
         "node": ">= 0.8"
       }
     },
-    "node_modules/fs-constants": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
-      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
-      "license": "MIT"
-    },
     "node_modules/fsevents": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
@@ -4216,12 +4084,6 @@
         "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
       }
     },
-    "node_modules/github-from-package": {
-      "version": "0.0.0",
-      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
-      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
-      "license": "MIT"
-    },
     "node_modules/glob-parent": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
@@ -4362,26 +4224,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/ieee754": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
     "node_modules/indent-string": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
@@ -4398,12 +4240,6 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
-    "node_modules/ini": {
-      "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
-      "license": "ISC"
-    },
     "node_modules/ip-address": {
       "version": "10.1.0",
       "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
@@ -4776,18 +4612,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/mimic-response": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
-      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/min-indent": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/min-indent/-/min-indent-1.0.1.tgz",
@@ -4798,15 +4622,6 @@
         "node": ">=4"
       }
     },
-    "node_modules/minimist": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/minipass": {
       "version": "7.1.3",
       "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
@@ -4828,12 +4643,6 @@
         "node": ">= 18"
       }
     },
-    "node_modules/mkdirp-classic": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
-      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
-      "license": "MIT"
-    },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -4869,12 +4678,6 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
-    "node_modules/napi-build-utils": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
-      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
-      "license": "MIT"
-    },
     "node_modules/negotiator": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
@@ -4884,28 +4687,13 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/node-abi": {
-      "version": "3.89.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.89.0.tgz",
-      "integrity": "sha512-6u9UwL0HlAl21+agMN3YAMXcKByMqwGx+pq+P76vii5f7hTPtKDp08/H9py6DY+cfDw7kQNTGEj/rly3IgbNQA==",
+    "node_modules/node-addon-api": {
+      "version": "8.9.2",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.9.2.tgz",
+      "integrity": "sha512-VijLXbi3UACN69I0JVXJsX4tjACjNoQDgv2gTF6sx2wWEi8tkSg2eX8p5gSIFi8z2+DL3oHmY6OyKce38SDolg==",
       "license": "MIT",
-      "dependencies": {
-        "semver": "^7.3.5"
-      },
       "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/node-abi/node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
+        "node": "^18 || ^20 || >= 21"
       }
     },
     "node_modules/node-releases": {
@@ -5246,33 +5034,6 @@
       "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==",
       "license": "MIT"
     },
-    "node_modules/prebuild-install": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
-      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
-      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
-      "license": "MIT",
-      "dependencies": {
-        "detect-libc": "^2.0.0",
-        "expand-template": "^2.0.3",
-        "github-from-package": "0.0.0",
-        "minimist": "^1.2.3",
-        "mkdirp-classic": "^0.5.3",
-        "napi-build-utils": "^2.0.0",
-        "node-abi": "^3.3.0",
-        "pump": "^3.0.0",
-        "rc": "^1.2.7",
-        "simple-get": "^4.0.0",
-        "tar-fs": "^2.0.0",
-        "tunnel-agent": "^0.6.0"
-      },
-      "bin": {
-        "prebuild-install": "bin.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/pretty-format": {
       "version": "27.5.1",
       "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
@@ -5302,16 +5063,6 @@
         "node": ">= 0.10"
       }
     },
-    "node_modules/pump": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
-      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
-      "license": "MIT",
-      "dependencies": {
-        "end-of-stream": "^1.1.0",
-        "once": "^1.3.1"
-      }
-    },
     "node_modules/punycode": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
@@ -5397,21 +5148,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/rc": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
-      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
-      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
-      "dependencies": {
-        "deep-extend": "^0.6.0",
-        "ini": "~1.3.0",
-        "minimist": "^1.2.0",
-        "strip-json-comments": "~2.0.1"
-      },
-      "bin": {
-        "rc": "cli.js"
-      }
-    },
     "node_modules/react": {
       "version": "19.2.4",
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.4.tgz",
@@ -5529,20 +5265,6 @@
         "pify": "^2.3.0"
       }
     },
-    "node_modules/readable-stream": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
-      "license": "MIT",
-      "dependencies": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
     "node_modules/readdirp": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
@@ -5721,26 +5443,6 @@
         "queue-microtask": "^1.2.2"
       }
     },
-    "node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -5948,51 +5650,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/simple-concat": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
-      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/simple-get": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
-      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "decompress-response": "^6.0.0",
-        "once": "^1.3.1",
-        "simple-concat": "^1.0.0"
-      }
-    },
     "node_modules/smol-toml": {
       "version": "1.8.0",
       "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.8.0.tgz",
@@ -6037,15 +5694,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/string_decoder": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "~5.2.0"
-      }
-    },
     "node_modules/strip-indent": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/strip-indent/-/strip-indent-3.0.0.tgz",
@@ -6059,15 +5707,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/strip-json-comments": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
-      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/strip-literal": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/strip-literal/-/strip-literal-3.1.0.tgz",
@@ -6164,34 +5803,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/tar-fs": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
-      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
-      "license": "MIT",
-      "dependencies": {
-        "chownr": "^1.1.1",
-        "mkdirp-classic": "^0.5.2",
-        "pump": "^3.0.0",
-        "tar-stream": "^2.1.4"
-      }
-    },
-    "node_modules/tar-stream": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
-      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
-      "license": "MIT",
-      "dependencies": {
-        "bl": "^4.0.3",
-        "end-of-stream": "^1.4.1",
-        "fs-constants": "^1.0.0",
-        "inherits": "^2.0.3",
-        "readable-stream": "^3.1.1"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/tar/node_modules/chownr": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
@@ -6390,18 +6001,6 @@
         "fsevents": "~2.3.3"
       }
     },
-    "node_modules/tunnel-agent": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "safe-buffer": "^5.0.1"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/type-is": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
@@ -7414,20 +7013,16 @@
     },
     "packages/cli": {
       "name": "@openrig/cli",
-      "version": "0.5.9",
-      "bundleDependencies": [
-        "@openrig/daemon"
-      ],
+      "version": "0.6.3",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@hono/node-server": "^1.13.0",
         "@hono/node-ws": "^1.3.1",
         "@modelcontextprotocol/sdk": "^1.28.0",
-        "@openrig/daemon": "*",
         "ajv": "^8.18.0",
         "ajv-formats": "^3.0.1",
-        "better-sqlite3": "^11.8.0",
+        "better-sqlite3": "^13.0.3",
         "commander": "^13.0.0",
         "hono": "^4.7.0",
         "jsonc-parser": "^3.3.1",
@@ -7447,17 +7042,17 @@
         "vitest": "^3.0.0"
       },
       "engines": {
-        "node": ">=20"
+        "node": ">=22"
       }
     },
     "packages/daemon": {
       "name": "@openrig/daemon",
-      "version": "0.5.9",
+      "version": "0.6.3",
       "license": "Apache-2.0",
       "dependencies": {
         "@hono/node-server": "^1.13.0",
         "@hono/node-ws": "^1.3.1",
-        "better-sqlite3": "^11.8.0",
+        "better-sqlite3": "^13.0.3",
         "hono": "^4.7.0",
         "smol-toml": "^1.8.0",
         "tar": "^7.5.13",
@@ -7473,7 +7068,7 @@
         "vitest": "^3.0.0"
       },
       "engines": {
-        "node": "^20 || ^22 || ^24"
+        "node": "^22 || ^24"
       }
     },
     "packages/tui": {
@@ -7493,7 +7088,7 @@
     },
     "packages/ui": {
       "name": "@openrig/ui",
-      "version": "0.5.9",
+      "version": "0.6.3",
       "license": "Apache-2.0",
       "dependencies": {
         "@fontsource-variable/jetbrains-mono": "^5.2.8",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openrig",
-  "version": "0.5.9",
+  "version": "0.6.3",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
@@ -13,7 +13,7 @@
   "scripts": {
     "build": "npm run build --workspaces",
     "test": "npm run test:repo && npm run test:workspaces",
-    "test:repo": "npm run build -w packages/daemon && node --test scripts/*.test.mjs && node scripts/check-docs-guard.mjs && node scripts/mirror-skills.mjs --check && node scripts/generate-context-packs.mjs --check",
+    "test:repo": "npm run build -w packages/daemon && node --test --test-concurrency=1 scripts/*.test.mjs && node scripts/check-docs-guard.mjs && node scripts/mirror-skills.mjs --check && node scripts/generate-context-packs.mjs --check",
     "test:workspaces": "npm run test -w packages/daemon -w packages/cli -w packages/tui",
     "test:ui": "npm run test -w packages/ui",
     "typecheck:prep": "npm run build -w packages/daemon",
@@ -28,6 +28,6 @@
     "gate": "node scripts/gate-lane.mjs"
   },
   "engines": {
-    "node": "^20 || ^22 || ^24"
+    "node": "^22 || ^24"
   }
 }

packages/cli/.gitignore

@@ -1,3 +1,6 @@
 # Build artifacts assembled by scripts/build-package.sh
 daemon/
 ui/
+
+# Root license copied by the CLI build
+/LICENSE

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/cli",
-  "version": "0.5.9",
+  "version": "0.6.3",
   "type": "module",
   "description": "Local control plane for multi-agent coding topologies",
   "keywords": [
@@ -30,6 +30,7 @@
     "openrig-tui": "tui/dist/main.js"
   },
   "files": [
+    "LICENSE",
     "dist",
     "daemon",
     "ui",
@@ -37,7 +38,7 @@
     "scripts"
   ],
   "scripts": {
-    "build": "tsc && chmod +x dist/bin-wrapper.js && mkdir -p dist/schemas && cp src/schemas/*.json dist/schemas/ && mkdir -p dist/lib/scope-templates && cp src/lib/scope-templates/*.md dist/lib/scope-templates/",
+    "build": "tsc && chmod +x dist/bin-wrapper.js && mkdir -p dist/schemas && cp src/schemas/*.json dist/schemas/ && mkdir -p dist/lib/scope-templates && cp src/lib/scope-templates/*.md dist/lib/scope-templates/ && cp ../../LICENSE LICENSE",
     "postinstall": "node scripts/check-abi.mjs",
     "prepublishOnly": "bash ../../scripts/build-package.sh",
     "test": "vitest run",
@@ -47,10 +48,9 @@
     "@hono/node-server": "^1.13.0",
     "@hono/node-ws": "^1.3.1",
     "@modelcontextprotocol/sdk": "^1.28.0",
-    "@openrig/daemon": "*",
     "ajv": "^8.18.0",
     "ajv-formats": "^3.0.1",
-    "better-sqlite3": "^11.8.0",
+    "better-sqlite3": "^13.0.3",
     "commander": "^13.0.0",
     "hono": "^4.7.0",
     "jsonc-parser": "^3.3.1",
@@ -60,15 +60,12 @@
     "yaml": "^2.8.3",
     "zod": "^4.3.6"
   },
-  "bundledDependencies": [
-    "@openrig/daemon"
-  ],
   "devDependencies": {
     "@types/node": "^22.0.0",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   }
 }

packages/cli/scripts/check-abi.mjs

@@ -1,103 +1,153 @@
 #!/usr/bin/env node
 
-// Postinstall ABI sanity check for @openrig/cli.
-// Fails loudly if better-sqlite3 native binary does not match the active
-// Node runtime. Layered on top of the engines.node constraint in
-// package.json — engines warns at npm level; this hard-blocks at install
-// time with a copy-paste fix.
+// Postinstall native-SQLite check for @openrig/cli.
+// OpenRig supports Node.js 22 and 24. better-sqlite3 13 requires Node 22 or
+// newer; on Node 20 it installs and loads, then crashes (SIGSEGV) the first
+// time a database is opened. This check refuses unsupported majors BEFORE any
+// native code runs, then proves the binding can actually open a database.
+// The open runs in a child process so a native crash is reported, not silent.
+
+const SUPPORTED_MAJORS = [22, 24];
+
+const box = (lines) =>
+  [
+    "",
+    "  ╔══════════════════════════════════════════════════════════════╗",
+    ...lines.map((line) => `  ║  ${line.padEnd(60)}║`),
+    "  ╚══════════════════════════════════════════════════════════════╝",
+    "",
+  ].join("\n");
+
+const FIX_INSTALL = "Fix:  nvm install 22 && npm install -g @openrig/cli";
 
 /**
- * @param {{ nodeVersion: string, loadNativeAddon: () => void }} deps
- * @returns {{ ok: true } | { ok: false, message: string }}
+ * @param {{
+ *   nodeVersion: string,
+ *   loadNativeAddon: () => void,
+ *   openNativeDatabase?: () => { ok: true } | { ok: false, detail: string },
+ * }} deps
+ * @returns {{ ok: true, warning?: string } | { ok: false, message: string }}
  */
-export function checkAbi({ nodeVersion, loadNativeAddon }) {
-  // Phase 1: version-range check (fast path).
-  // Even-numbered Node majors (20, 22, 24) are LTS lines with native addon
-  // prebuilds. Odd-numbered majors (21, 23, 25) generally lack them.
+export function checkAbi({ nodeVersion, loadNativeAddon, openNativeDatabase }) {
+  // Phase 1: version-range check. Runs before any native code is loaded.
   const match = nodeVersion.match(/^v?(\d+)/);
   const major = match ? parseInt(match[1], 10) : 0;
 
-  if (major < 20) {
+  if (major < SUPPORTED_MAJORS[0]) {
     return {
       ok: false,
-      message: [
+      message: box([
+        "@openrig/cli requires Node.js 22 or 24 (LTS).",
+        `Current: ${nodeVersion}`,
         "",
-        "  ╔══════════════════════════════════════════════════════════════╗",
-        `  ║  @openrig/cli requires Node.js 20, 22, or 24 (LTS).       ║`,
-        `  ║  Current: ${nodeVersion.padEnd(49)}║`,
-        "  ║                                                            ║",
-        "  ║  Fix:  nvm install 22 && npm install -g @openrig/cli       ║",
-        "  ╚══════════════════════════════════════════════════════════════╝",
+        "Node 20 is no longer supported: the SQLite binding",
+        "(better-sqlite3 13) crashes when it opens a database there.",
         "",
-      ].join("\n"),
+        FIX_INSTALL,
+      ]),
     };
   }
 
   if (major % 2 !== 0) {
     return {
       ok: false,
-      message: [
+      message: box([
+        "@openrig/cli does not support odd-numbered Node releases.",
+        `Current: ${nodeVersion}`,
         "",
-        "  ╔══════════════════════════════════════════════════════════════╗",
-        `  ║  @openrig/cli does not support odd-numbered Node releases.  ║`,
-        `  ║  Current: ${nodeVersion.padEnd(49)}║`,
-        "  ║                                                            ║",
-        "  ║  Odd Node versions (21, 23, 25, …) lack native addon       ║",
-        "  ║  prebuilds for better-sqlite3. The daemon will fail.       ║",
-        "  ║                                                            ║",
-        "  ║  Fix:  nvm install 22 && npm install -g @openrig/cli       ║",
-        "  ╚══════════════════════════════════════════════════════════════╝",
+        "Supported: Node.js 22 and 24 (LTS).",
         "",
-      ].join("\n"),
+        FIX_INSTALL,
+      ]),
     };
   }
 
-  // Phase 2: ABI load check (catches edge cases like local Node builds
-  // or prebuild packaging gaps on supported versions).
+  // Even majors above the supported range are untested, not refused.
+  const warning = SUPPORTED_MAJORS.includes(major)
+    ? undefined
+    : box([
+        `Node ${major} is untested with @openrig/cli.`,
+        `Current: ${nodeVersion}`,
+        "",
+        "Supported: Node.js 22 and 24 (LTS). The SQLite check below",
+        "passed, but other behavior on this Node is unverified.",
+      ]);
+
+  // Phase 2: load the native addon (ABI / packaging / permission problems).
   try {
     loadNativeAddon();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     const isAbiMismatch = detail.includes("NODE_MODULE_VERSION");
 
-    if (isAbiMismatch) {
-      return {
-        ok: false,
-        message: [
-          "",
-          "  ╔══════════════════════════════════════════════════════════════╗",
-          "  ║  better-sqlite3 native binary does not match this Node.    ║",
-          `  ║  Current: ${nodeVersion.padEnd(49)}║`,
-          "  ║                                                            ║",
-          "  ║  Fix:  npm rebuild better-sqlite3                          ║",
-          "  ║   or:  nvm install 22 && npm install -g @openrig/cli       ║",
-          "  ╚══════════════════════════════════════════════════════════════╝",
-          "",
-          `  Detail: ${detail}`,
-          "",
-        ].join("\n"),
-      };
-    }
-
     return {
       ok: false,
-      message: [
-        "",
-        "  ╔══════════════════════════════════════════════════════════════╗",
-        "  ║  better-sqlite3 native addon failed to load.               ║",
-        `  ║  Current: ${nodeVersion.padEnd(49)}║`,
-        "  ║                                                            ║",
-        "  ║  Fix:  npm rebuild better-sqlite3                          ║",
-        "  ║  If that fails, reinstall with a supported Node version:   ║",
-        "  ║        nvm install 22 && npm install -g @openrig/cli       ║",
-        "  ╚══════════════════════════════════════════════════════════════╝",
-        "",
-        `  Detail: ${detail}`,
-        "",
-      ].join("\n"),
+      message:
+        box(
+          isAbiMismatch
+            ? [
+                "better-sqlite3 native binary does not match this Node.",
+                `Current: ${nodeVersion}`,
+                "",
+                "Fix:  npm rebuild better-sqlite3",
+                " or:  nvm install 22 && npm install -g @openrig/cli",
+              ]
+            : [
+                "better-sqlite3 native addon failed to load.",
+                `Current: ${nodeVersion}`,
+                "",
+                "Fix:  npm rebuild better-sqlite3",
+                "If that fails, reinstall with a supported Node version:",
+                "      nvm install 22 && npm install -g @openrig/cli",
+              ],
+        ) + `  Detail: ${detail}\n`,
     };
   }
 
+  // Phase 3: open an in-memory database. Loading alone does not prove the
+  // binding works (Node 20 + better-sqlite3 13 loads, then segfaults here).
+  if (openNativeDatabase) {
+    const opened = openNativeDatabase();
+    if (!opened.ok) {
+      return {
+        ok: false,
+        message:
+          box([
+            "better-sqlite3 loaded but could not open a database.",
+            `Current: ${nodeVersion}`,
+            "",
+            "Fix:  npm rebuild better-sqlite3",
+            "If that fails, reinstall with Node 22 or 24:",
+            "      nvm install 22 && npm install -g @openrig/cli",
+          ]) + `  Detail: ${opened.detail}\n`,
+      };
+    }
+  }
+
+  return warning ? { ok: true, warning } : { ok: true };
+}
+
+/**
+ * Open an in-memory database in a child process, so a native crash
+ * (e.g. SIGSEGV) is observed as a signal instead of killing this script.
+ * @param {string} addonPath absolute path resolved from this package
+ */
+export function openInChildProcess(addonPath, spawnSync) {
+  const probe =
+    `const Database = require(${JSON.stringify(addonPath)});` +
+    `const db = new Database(":memory:");` +
+    `db.prepare("select sqlite_version() as v").get();` +
+    `db.close();`;
+  const result = spawnSync(process.execPath, ["-e", probe], {
+    encoding: "utf8",
+    timeout: 30_000,
+  });
+  if (result.error) return { ok: false, detail: result.error.message };
+  if (result.signal) return { ok: false, detail: `database open was killed by ${result.signal}` };
+  if (result.status !== 0) {
+    const stderr = (result.stderr || "").trim().split("\n").slice(-3).join(" ");
+    return { ok: false, detail: `database open exited ${result.status}${stderr ? `: ${stderr}` : ""}` };
+  }
   return { ok: true };
 }
 
@@ -109,15 +159,19 @@ const isMain =
 
 if (isMain) {
   const { createRequire } = await import("node:module");
+  const { spawnSync } = await import("node:child_process");
   const require = createRequire(import.meta.url);
 
   const result = checkAbi({
     nodeVersion: process.version,
     loadNativeAddon: () => require("better-sqlite3"),
+    openNativeDatabase: () => openInChildProcess(require.resolve("better-sqlite3"), spawnSync),
   });
 
   if (!result.ok) {
     console.error(result.message);
     process.exitCode = 1;
+  } else if (result.warning) {
+    console.error(result.warning);
   }
 }

packages/cli/src/bin-wrapper.ts

@@ -52,6 +52,10 @@ function maybeReexecWithSiblingNode(argv = process.argv): void {
   if (!preferredNode) return;
 
   const scriptPath = argv[1] ? realpathSync(argv[1]) : fileURLToPath(import.meta.url);
+  // An alias is not runtime authority. Keep a working interpreter; only switch
+  // when the installed native dependency actually loads under the alternative.
+  if (canLoadInstalledNative(process.execPath, scriptPath)) return;
+  if (!canLoadInstalledNative(preferredNode, scriptPath)) return;
   const result = spawnSync(preferredNode, [scriptPath, ...argv.slice(2)], {
     stdio: "inherit",
     env: {
@@ -67,6 +71,14 @@ function maybeReexecWithSiblingNode(argv = process.argv): void {
   process.exit(result.status ?? 0);
 }
 
+export function canLoadInstalledNative(node: string, wrapper: string): boolean {
+  const probe = spawnSync(node, ["--input-type=module", "-e",
+    "import {createRequire} from 'node:module'; const require=createRequire(process.argv[1]); const D=require('better-sqlite3'); new D(':memory:').close();",
+    wrapper,
+  ], { encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "pipe"] });
+  return probe.status === 0;
+}
+
 export async function run(argv = process.argv): Promise<void> {
   const normalizedArgv = [...argv];
   if (normalizedArgv[1]) {

packages/cli/src/client.ts

@@ -3,6 +3,7 @@ import path from "node:path";
 import { ConfigStore } from "./config-store.js";
 import { readOpenRigEnv } from "./openrig-compat.js";
 import { fetchWithTimeout, FetchTimeoutError } from "./fetch-with-timeout.js";
+import { readLocalOrigin } from "./local-origin.js";
 
 export function terminalAuthHeaders(): Record<string, string> {
   const token = resolveTerminalToken();
@@ -23,14 +24,7 @@ export const SENDER_IDENTITY_HEADER = "X-OpenRig-Session";
 export function senderIdentityHeaders(originSelfHostId?: string): Record<string, string> {
   const session = readOpenRigEnv("OPENRIG_SESSION_NAME", "RIGGED_SESSION_NAME")?.trim();
   if (!session) return {};
-  // A4 HTTP-path origin-triple carry: on a REMOTE-targeting client, compose the origin TRIPLE
-  // (member@rig@<this host's selfHostId>) at stamp time so the remote daemon's wrapPaneEnvelope
-  // renders the ORIGIN host, not the destination's (its preserve branch fires on a 3-part sender).
-  // The identity stays DERIVED — env session + THIS host's own selfHostId — never a caller-supplied
-  // string (Rail 1 anti-forgery: `originSelfHostId` signals only THAT the client targets a remote host,
-  // never WHO it is). An already-3-part origin (an upstream relay's triple) is preserved verbatim,
-  // never re-stamped with this host's id (which would forge the origin). Local clients pass no
-  // `originSelfHostId` and stamp the 2-part value, byte-identical to today.
+  // Preserve qualified senders; append only a locally derived instance id.
   const value =
     originSelfHostId && originSelfHostId.length > 0 && session.split("@").length < 3
       ? `${session}@${originSelfHostId}`
@@ -38,18 +32,7 @@ export function senderIdentityHeaders(originSelfHostId?: string): Record<string,
   return { [SENDER_IDENTITY_HEADER]: value };
 }
 
-/**
- * A4 — the SINGLE remote-origin construction point (shape b). Every remote-targeting client is built
- * HERE so the origin triple is stamped uniformly. Two structural laws the A4 grep-guard enforces:
- * (1) no remote site constructs a client by calling `clientFactory(<registry host>.url)` directly —
- * they all route through here; (2) `originSelfHostId` is ASSIGNED in exactly ONE place: this function
- * (the sole-assignment law, so pin 3 "no caller-supplied identity path" is structurally true).
- *
- * `originSelfHostId` is THIS host's own id (resolved fail-open via `fetchSelfHostId` on the LOCAL
- * daemon), NOT a caller-supplied identity — the caller only signals it targets a remote host. Preserves
- * the injected-mock `clientFactory` test seam: the client is built by the injected factory; this only
- * sets a field on it afterward (an injected mock harmlessly carries the extra property).
- */
+/** Construct registered remote clients with the origin derived from this instance's durable store. */
 export function remoteDaemonClient(
   clientFactory: (baseUrl: string) => DaemonClient,
   url: string,
@@ -57,6 +40,7 @@ export function remoteDaemonClient(
 ): DaemonClient {
   const client = clientFactory(url);
   client.originSelfHostId = originSelfHostId;
+  client.remoteTarget = true;
   return client;
 }
 
@@ -93,7 +77,7 @@ export class DaemonTimeoutError extends DaemonConnectionError {
 }
 
 /**
- * Bad-response: the daemon replied, but the body could not be read as JSON
+ * Bad-response: the daemon replied, but the body could not be read or parsed as JSON
  * (truncated / unparseable / non-JSON — a real symptom under daemon saturation).
  * DISTINCT from a stopped or unreachable daemon: the request WAS delivered and
  * the outcome is unknown, so this must never render as daemon-not-running.
@@ -129,15 +113,41 @@ export class DaemonClient {
   readonly baseUrl: string;
   private fetchImpl: typeof fetch = fetch;
   private timeoutMs = 5_000;
-  /**
-   * A4 HTTP-path origin-triple carry: THIS host's `selfHostId`, set ONLY when this client targets a
-   * REMOTE host, so `senderIdentityHeaders` stamps the origin TRIPLE (member@rig@selfHostId) instead of
-   * the 2-part local value. Undefined for local clients (2-part stamp, unchanged). Assigned in EXACTLY
-   * ONE place — `remoteDaemonClient` — enforced by the A4 grep-guard (the sole-assignment law); this is
-   * NOT a caller identity string (Rail 1: it is THIS host's derived id, never who the caller claims to
-   * be). Public (not ctor-injected) to keep the injected-mock `clientFactory` test seam untouched.
-   */
+  /** Set by remoteDaemonClient; absent origin is labelled explicitly on remote requests. */
   originSelfHostId?: string;
+  remoteTarget = false;
+  private identity?: Promise<Record<string, string>>;
+  private originUnknown = false;
+
+  private async identityHeaders(): Promise<Record<string, string>> {
+    const localHeaders = senderIdentityHeaders();
+    const session = localHeaders[SENDER_IDENTITY_HEADER];
+    if (!session || session.split("@").length >= 3) return localHeaders;
+    const directTarget = readOpenRigEnv("OPENRIG_URL", "RIGGED_URL");
+    if (!this.remoteTarget && !directTarget) return localHeaders;
+    const origin = this.originSelfHostId ?? readLocalOrigin();
+    if (!origin) {
+      this.originUnknown = true;
+      return { ...localHeaders, "X-OpenRig-Origin-Unknown": "true" };
+    }
+    if (!this.remoteTarget) {
+      // Loopback may be a forwarded endpoint. Only matching instance identity proves locality.
+      const controller = new AbortController();
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      try {
+        const target = await Promise.race([
+          (async () => {
+            const res = await this.fetchImpl(`${this.baseUrl.replace(/\/+$/, "")}/healthz`, { signal: controller.signal });
+            return res.ok ? (await res.json() as { selfHostId?: unknown }).selfHostId : undefined;
+          })(),
+          new Promise<undefined>(resolve => { timer = setTimeout(() => resolve(undefined), Math.min(this.timeoutMs, 1000)); }),
+        ]);
+        if (target === origin) return localHeaders;
+      } catch { /* Unproved locality: carry the known origin, never the endpoint's identity. */ }
+      finally { clearTimeout(timer); controller.abort(); }
+    }
+    return senderIdentityHeaders(origin);
+  }
 
   constructor(baseUrl?: string, options?: DaemonClientOptions) {
     if (baseUrl) {
@@ -206,26 +216,36 @@ export class DaemonClient {
     }, options);
   }
 
-  private async fetch(path: string, init: RequestInit, options?: DaemonRequestOptions): Promise<Response> {
+  private async fetch(path: string, init: RequestInit, options?: DaemonRequestOptions, consumeResponse?: (response: Response) => Promise<void>): Promise<Response> {
     const timeoutMs = options?.timeoutMs ?? this.timeoutMs;
     if (options?.headers) {
       init = { ...init, headers: { ...(init.headers as Record<string, string> ?? {}), ...options.headers } };
     }
     // P18 sender-provenance: stamp the seat-derived identity header LAST, so the transport — never a
     // caller-supplied header or a request body — decides the caller identity the channel of record records.
-    // A4: a remote-targeting client (originSelfHostId set by remoteDaemonClient) stamps the origin TRIPLE;
-    // local clients stamp the 2-part value, byte-identical to today.
-    init = { ...init, headers: { ...(init.headers as Record<string, string> ?? {}), ...senderIdentityHeaders(this.originSelfHostId) } };
+    // Known remote or unproved direct endpoints carry origin; proven local requests remain bare.
+    this.identity ??= this.identityHeaders();
+    init = { ...init, headers: { ...(init.headers as Record<string, string> ?? {}), ...await this.identity } };
+    let responseStatus: number | undefined;
     try {
-      return await fetchWithTimeout(
+      const response = await fetchWithTimeout(
         this.fetchImpl,
         `${this.baseUrl}${path}`,
         init,
         {
           timeoutMs,
+          consumeResponse: consumeResponse ? async (response) => {
+            responseStatus = response.status;
+            await consumeResponse(response);
+          } : undefined,
           timeoutMessage: `Request to ${this.baseUrl}${path} timed out after ${timeoutMs}ms`,
         },
       );
+      if (response.ok && this.originUnknown) {
+        console.error("Origin instance unknown: local durable identity is unavailable; delivery continues with origin-unknown provenance.");
+        this.originUnknown = false;
+      }
+      return response;
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       // Slow-response (a timed-out request) is a DISTINCT class from no-connect:
@@ -234,18 +254,21 @@ export class DaemonClient {
       if (err instanceof FetchTimeoutError) {
         throw new DaemonTimeoutError(`The OpenRig daemon at ${this.baseUrl} did not respond in time: ${msg}`);
       }
+      // Headers prove that the daemon received the request, but not that a write
+      // finished. A dropped body must preserve unknown-outcome guidance.
+      if (responseStatus !== undefined) throw new DaemonResponseError(responseStatus, "");
       throw new DaemonConnectionError(`Cannot connect to the OpenRig daemon at ${this.baseUrl}: ${msg}`);
     }
   }
 
   private async requestJson<T>(path: string, init: RequestInit, options?: DaemonRequestOptions): Promise<DaemonResponse<T>> {
-    const res = await this.fetch(path, init, options);
+    let text = "";
+    const res = await this.fetch(path, init, options, async (response) => { text = await response.text(); });
     // Read the raw body once, THEN parse — so a truncated / unparseable response
     // (a real symptom under daemon saturation) surfaces as a typed
     // DaemonResponseError carrying the status + a bounded snippet, instead of a
     // raw SyntaxError bubbling to a cryptic (json) or silent (human) CLI exit.
     // A well-formed non-2xx body still parses and returns {status,data}; 204 has none.
-    const text = await res.text();
     if (res.status === 204) return { status: res.status, data: undefined as T };
     try {
       return { status: res.status, data: JSON.parse(text) as T };
@@ -255,8 +278,8 @@ export class DaemonClient {
   }
 
   private async requestText(path: string, init: RequestInit, options?: DaemonRequestOptions): Promise<DaemonResponse<string>> {
-    const res = await this.fetch(path, init, options);
-    const data = await res.text();
+    let data = "";
+    const res = await this.fetch(path, init, options, async (response) => { data = await response.text(); });
     return { status: res.status, data };
   }
 }

packages/cli/src/commands/attach.ts

@@ -84,7 +84,7 @@ export function attachCommand(depsOverride?: StatusDeps): Command {
       }
 
       const hasNode = !!opts.node;
-      const hasPodFields = !!opts.pod || !!opts.member || !!opts.runtime;
+      const hasPodFields = !!opts.pod || !!opts.member;
       if (hasNode && hasPodFields) {
         console.error("Specify either --node or --pod + --member + --runtime, not both.");
         process.exitCode = 1;

packages/cli/src/commands/bundle.ts

@@ -85,8 +85,10 @@ export function bundleCommand(depsOverride?: StatusDeps): Command {
       // bundle sizes; if a bundle author hits this, the daemon-side
       // operation is async-completable in a future /bundles/jobs/<id>
       // surface (not in slice-05 scope).
+      // Paths are resolved here, against the operator's cwd: the daemon would otherwise resolve
+      // them against ITS cwd. Nothing is uploaded — the files must exist on the daemon's host.
       const res = await client.post<Record<string, unknown>>("/api/bundles/create", {
-        specPath: spec, bundleName: opts.name, bundleVersion: opts.bundleVersion, outputPath: opts.output,
+        specPath: nodePath.resolve(spec), bundleName: opts.name, bundleVersion: opts.bundleVersion, outputPath: nodePath.resolve(opts.output),
         includePackages: opts.includePackages,
         rigRoot: opts.rigRoot ? nodePath.resolve(opts.rigRoot) : undefined,
         provenance: buildClientProvenance(opts.notes),
@@ -117,7 +119,7 @@ export function bundleCommand(depsOverride?: StatusDeps): Command {
       const client = await getClient(deps);
       if (!client) { process.exitCode = 1; return; }
 
-      const res = await client.post<Record<string, unknown>>("/api/bundles/inspect", { bundlePath });
+      const res = await client.post<Record<string, unknown>>("/api/bundles/inspect", { bundlePath: nodePath.resolve(bundlePath) });
 
       // Check for structured failures (200 with error or failed integrity)
       const hasError = typeof res.data["error"] === "string";
@@ -166,7 +168,8 @@ export function bundleCommand(depsOverride?: StatusDeps): Command {
       // daemon completed the mutating install — operator-unsafe retry
       // path (rig_name_collision on second attempt). Bumped to 120s.
       const res = await client.post<Record<string, unknown>>("/api/bundles/install", {
-        bundlePath, plan: opts.plan ?? false, autoApprove: opts.yes ?? false, targetRoot: opts.target,
+        bundlePath: nodePath.resolve(bundlePath), plan: opts.plan ?? false, autoApprove: opts.yes ?? false,
+        targetRoot: opts.target ? nodePath.resolve(opts.target) : undefined,
         // Item 2 / slice-05 Checkpoint 3.3: send CLI version + skip flag for the
         // daemon-side install-time compatibility check. CLI version read at call
         // time (no module-level constant) via the existing getCliVersion helper.

packages/cli/src/commands/config.ts

@@ -73,8 +73,10 @@ Keys:
   context.system_world   default System World, replacement manifest path, or disabled
   skills.root            versioned skill catalog (default $OPENRIG_HOME/skills)
   onboarding.default_pack.enabled  deliver the two-part fresh-seat mental-model pack (default on)
+  health.context_pressure.*        context-pressure warning/critical percentages (defaults 95/99)
   files.allowlist        name:/abs/path,name:/abs/path
   progress.scan_roots    name:/abs/path,name:/abs/path
+  ui.timezone            TUI IANA timezone (default America/Los_Angeles; reopen TUI after changing)
   ui.preview.*           refresh_interval_seconds, max_pins, default_lines
   recovery.*             auto_drive_provider_prompts, provider_auth_env_allowlist
   agents.*               advisor_session, operator_session

packages/cli/src/commands/context.ts

@@ -17,18 +17,19 @@ import {
   lstatSync,
   mkdirSync,
   mkdtempSync,
-  readdirSync,
   readFileSync,
   renameSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
 import { dirname } from "node:path";
-import { basename, extname, isAbsolute, join, resolve } from "node:path";
+import { basename, join, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
-import { ATOM_TAXONOMIES, TAXONOMY_TEACHING } from "@openrig/daemon/context-pack-taxonomy";
+import { assertSafeInstallRef, assertTreeHasNoSymlinks, assertDestinationNamespaceContained, validateContextPackManifestForInstall } from "../lib/context-install.js";
+import { addGitContext, inspectGitContext, updateGitContext } from "../lib/context-git.js";
 import { ConfigStore } from "../config-store.js";
 import { DaemonClient } from "../client.js";
+import { enumArg } from "../cli-error.js";
 import { getDaemonStatus, getDaemonUrl , statusGuardMessage} from "../daemon-lifecycle.js";
 import { resolveWorkPosition, type WorkInstallPlan } from "../lib/work-install.js";
 import {
@@ -36,11 +37,12 @@ import {
   resolveSkillLoadout,
   type ReconcileSkillLoadoutResult,
   type SkillLoadout,
-  type SkillRuntime,
 } from "@openrig/daemon/skill-loadout";
 import { realDeps } from "./daemon.js";
 import type { StatusDeps } from "./status.js";
 
+const contextRuntimeArg = enumArg(["claude-code", "claude", "codex"]);
+
 interface ContextPackEntryWire {
   id: string;
   kind: "context-pack";
@@ -96,141 +98,17 @@ interface PreviewWire {
   missingFiles: Array<{ path: string; role: string }>;
 }
 
-// Slice-03 Atom 2 — mirror the daemon's per-segment ref contract at the
-// local install boundary. This must run before creating the context store.
 const SAFE_REF_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 
-// Slice-03 lineage repair (R2 HIGH-2): the install boundary mirrors the daemon
-// bounded, delimiter-free version token (ref-safety.SAFE_VERSION) so an unsafe
-// version is rejected BEFORE any local write — matching the per-segment ref
-// mirror above.
-const SAFE_INSTALL_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,31}$/;
-
-function assertSafeInstallRef(ref: string): void {
-  const safe =
-    ref.length > 0 &&
-    ref.split("/").every(
-      (segment) => segment.length > 0 && segment !== "." && segment !== ".." && SAFE_REF_SEGMENT.test(segment),
-    );
-  if (!safe) {
-    throw new Error(
-      `unsafe install ref '${ref}' — a ref must be one or more '/'-separated segments, each matching ` +
-        `[A-Za-z0-9][A-Za-z0-9._-]{0,63} (no '.'/'..', no absolute path, no empty segment, no ` +
-        `whitespace or injection), so packs stay inside the context store root.`,
-    );
-  }
-}
-
 function assertSafeTopologySegment(kind: "rig" | "seat", value: string): void {
   if (value === "." || value === ".." || !SAFE_REF_SEGMENT.test(value)) {
     throw new Error(`unsafe ${kind} segment '${value}' — topology addresses require one bounded path segment`);
   }
 }
 
-function assertTreeHasNoSymlinks(root: string): void {
-  const stack = [root];
-  while (stack.length > 0) {
-    const current = stack.pop()!;
-    for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const absPath = join(current, entry.name);
-      if (entry.isSymbolicLink()) {
-        throw new Error(`Context pack directories must not contain symlinks: ${absPath}`);
-      }
-      if (entry.isDirectory()) stack.push(absPath);
-    }
-  }
-}
-
-// Slice-03 lineage repair (R2 HIGH-1): a lexically-safe path-like install ref
-// can still escape the store if one of its parent namespace segments is a
-// symlink (or a non-directory). Walk every ANCESTOR segment under the store root
-// and reject before the copy — the FS-canonical containment the lexical ref
-// check alone cannot give, mirroring the daemon compose namespace walk
-// (context-pack-library-service.ts). A not-yet-created segment (ENOENT) is safe:
-// cpSync will materialize it as a real directory.
-function assertDestinationNamespaceContained(targetRoot: string, installName: string): void {
-  const segments = installName.split("/");
-  let cursor = targetRoot;
-  for (const segment of segments.slice(0, -1)) {
-    cursor = join(cursor, segment);
-    let stat: ReturnType<typeof lstatSync>;
-    try {
-      stat = lstatSync(cursor);
-    } catch (err) {
-      if ((err as NodeJS.ErrnoException).code === "ENOENT") break;
-      throw err;
-    }
-    if (stat.isSymbolicLink() || !stat.isDirectory()) {
-      throw new Error(
-        `unsafe install ref '${installName}' — its namespace segment '${cursor}' is a symlink or non-directory, ` +
-          `so the copy would escape the context store root. Remove it or install under a different --name.`,
-      );
-    }
-  }
-}
-
-// Kept in lockstep with the daemon parser's ALLOWED_FILE_SUFFIXES (manifest-parser.ts).
-// OPR.0.5.3.7 R2 added .sh/.ts (skill helper assets, served as text); the install
-// validator must accept what the daemon will serve.
-const ALLOWED_CONTEXT_PACK_SUFFIXES = new Set([".md", ".markdown", ".yaml", ".yml", ".txt", ".sh", ".ts"]);
-
-function validateContextPackManifestForInstall(manifestPath: string): void {
-  let parsed: unknown;
-  try {
-    parsed = parseYaml(readFileSync(manifestPath, "utf-8"));
-  } catch (err) {
-    throw new Error(`manifest at ${manifestPath} is not valid YAML: ${(err as Error).message}`);
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error(`manifest at ${manifestPath} must be a YAML object at the root`);
-  }
-  const obj = parsed as Record<string, unknown>;
-  if (typeof obj["name"] !== "string" || obj["name"].length === 0) {
-    throw new Error(`manifest at ${manifestPath} is missing required field 'name' (string)`);
-  }
-  if (obj["version"] === undefined || obj["version"] === null) {
-    throw new Error(`manifest at ${manifestPath} is missing required field 'version'`);
-  }
-  const versionStr = String(obj["version"]);
-  if (!SAFE_INSTALL_VERSION.test(versionStr)) {
-    throw new Error(
-      `manifest at ${manifestPath} has an invalid version '${versionStr}' — a version must be a single bounded ` +
-        `token [A-Za-z0-9][A-Za-z0-9._+-]{0,31} (no ':' or separator, no whitespace, ≤32 chars).`,
-    );
-  }
-  // OPR.0.5.6.10 — teach the classification refusal at ADD time, not first
-  // daemon scan (desk ruling T2). Enum + teaching text imported from the
-  // daemon's one definition site; never a second value list here.
-  const taxonomy = obj["taxonomy"];
-  if (taxonomy === undefined || taxonomy === null) {
-    throw new Error(`manifest at ${manifestPath} is missing required field 'taxonomy' — every context pack declares what kind of context it is. ${TAXONOMY_TEACHING}`);
-  }
-  if (typeof taxonomy !== "string" || !(ATOM_TAXONOMIES as readonly string[]).includes(taxonomy)) {
-    throw new Error(`manifest at ${manifestPath} has invalid taxonomy ${JSON.stringify(taxonomy)}. ${TAXONOMY_TEACHING}`);
-  }
-  const files = obj["files"];
-  if (!Array.isArray(files)) {
-    throw new Error(`manifest at ${manifestPath} must declare 'files: [...]'`);
-  }
-  for (let i = 0; i < files.length; i++) {
-    const entry = files[i];
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-      throw new Error(`manifest at ${manifestPath} has malformed entry at files[${i}]`);
-    }
-    const file = entry as Record<string, unknown>;
-    const relPath = file["path"];
-    if (typeof relPath !== "string" || relPath.length === 0) {
-      throw new Error(`manifest at ${manifestPath} files[${i}] missing 'path' (string)`);
-    }
-    if (relPath.includes("..") || isAbsolute(relPath) || relPath.startsWith("\\")) {
-      throw new Error(`manifest at ${manifestPath} files[${i}].path '${relPath}' must be a relative path inside the pack (no '..' segments, no leading '/')`);
-    }
-    if (!ALLOWED_CONTEXT_PACK_SUFFIXES.has(extname(relPath))) {
-      throw new Error(`manifest at ${manifestPath} files[${i}].path '${relPath}' has an unsupported suffix; allowed: ${Array.from(ALLOWED_CONTEXT_PACK_SUFFIXES).join(", ")}`);
-    }
-    if (typeof file["role"] !== "string" || file["role"].length === 0) {
-      throw new Error(`manifest at ${manifestPath} files[${i}] missing 'role' (string)`);
-    }
+function assertLocalGitClient(client: DaemonClient): void {
+  if (!["127.0.0.1", "localhost", "[::1]"].includes(new URL(client.baseUrl).hostname)) {
+    throw new Error("Run Git source selection/inspection/update on the daemon host through its loopback URL; these commands use local Git and filesystem paths.");
   }
 }
 
@@ -357,6 +235,8 @@ Examples:
   rig context add ./my-pack
   rig context rm packs/compaction-restore
   rig context sync
+  rig context profile world-public --situation fresh --runtime claude-code
+  rig context work-install --runtime claude-code
   rig context trace --rig product-team --seat orch1-lead --name LEARNED.md
   rig context trace --rig product-team --pod delivery --seat dev1-qa --name LEARNED.md
 `);
@@ -372,12 +252,17 @@ Examples:
     .option("--mission <id>", "Exact mission id under the selected project")
     .option("--slice <id>", "Exact slice id under the selected mission")
     .option("--deliver", "Include the exact content of each extant planned file")
-    .option("--runtime <runtime>", "Inspect skills for claude-code or codex")
+    .option("--runtime <runtime>", "Inspect skills for claude-code (alias: claude) or codex", contextRuntimeArg)
     .option("--cwd <path>", "Agent working directory that receives skill projections (default: current directory)")
     .option("--topology <ids>", "Comma-separated topology/profile skill identities")
     .option("--apply-skills", "Reconcile selected skills into the runtime harness directory")
     .option("--json", "JSON output")
     .action((opts: { project?: string; mission?: string; slice?: string; deliver?: boolean; runtime?: string; cwd?: string; topology?: string; applySkills?: boolean; json?: boolean }) => {
+      if (opts.applySkills && opts.runtime === undefined) {
+        console.error("invalid_runtime: --apply-skills requires --runtime claude-code (alias: claude) or codex");
+        process.exitCode = 1;
+        return;
+      }
       const store = new ConfigStore();
       const workspaceRoot = String(store.resolveWithSource("workspace.root").value);
       const catalogPath = String(store.resolveWithSource("workspace.catalog_path").value);
@@ -401,17 +286,7 @@ Examples:
       }
       let skillLoadout: SkillLoadout | undefined;
       let skillProjection: ReconcileSkillLoadoutResult | undefined;
-      if (opts.applySkills && !opts.runtime) {
-        console.error("invalid_runtime: --apply-skills requires --runtime claude-code|codex");
-        process.exitCode = 1;
-        return;
-      }
       if (opts.runtime) {
-        if (opts.runtime !== "claude-code" && opts.runtime !== "codex") {
-          console.error("invalid_runtime: --runtime must be claude-code or codex");
-          process.exitCode = 1;
-          return;
-        }
         const topologySkills = (opts.topology ?? "").split(",").map((id) => id.trim()).filter(Boolean);
         const resolvedSkills = resolveSkillLoadout({
           catalogRoot: String(store.resolveWithSource("skills.root").value),
@@ -429,7 +304,7 @@ Examples:
         skillLoadout = resolvedSkills.loadout;
         skillProjection = reconcileSkillLoadout({
           loadout: skillLoadout,
-          runtime: opts.runtime as SkillRuntime,
+          runtime: opts.runtime === "codex" ? "codex" : "claude-code",
           cwd: resolve(opts.cwd ?? process.cwd()),
           apply: opts.applySkills === true,
         });
@@ -757,7 +632,7 @@ Examples:
     // the rule that the runtimes compose DIFFERENT profiles). Flag beats env;
     // an unrecognized env value falls back to claude rather than erroring a
     // surface the env owner may not control.
-    .option("--runtime <runtime>", "claude | codex (default: $OPENRIG_RUNTIME, else claude)")
+    .option("--runtime <runtime>", "claude-code (alias: claude) or codex (default: $OPENRIG_RUNTIME, else claude-code)", contextRuntimeArg)
     .option("--profile <profile>", "Named install profile declared by the pack (selection + ordered phases)")
     .option("--budget <tokens>", "Situation token budget — overage is REPORTED, never truncated")
     .option("--rig <rig>", "With --seat: grant read access to that seat's tree (seat: atoms)")
@@ -784,6 +659,8 @@ Examples:
             runtime = "claude";
           }
         }
+        // Keep the composer/manifest key and returned metadata compatible.
+        if (runtime === "claude-code") runtime = "claude";
         const params = new URLSearchParams({ ref: entry.relativePath, situation: opts.situation, runtime });
         if (opts.profile !== undefined) params.set("profile", opts.profile);
         if (opts.budget !== undefined) params.set("budget", opts.budget);
@@ -908,17 +785,26 @@ Examples:
     });
 
   cmd.command("add")
-    .argument("<source>", "Local directory OR http(s):// URL of a context pack (manifest.yaml + files)")
-    .description("Install a context pack from a local directory or a URL into the configured context library")
+    .argument("<source>", "Pack directory/manifest URL, or Git repository path/URL with --git")
+    .description("Install a pack; --git discovers a pack in a Git repository and retains its update relationship")
     .option("--name <name>", "Override the install name (defaults to the manifest name / source basename)")
+    .option("--git", "Clone a Git repository path/URL with existing Git credentials; select a pack snapshot")
+    .option("--checkout", "With --git, select an existing checkout instead of cloning; updates may merge in it")
+    .option("--pack <path>", "With --git, select a repository-relative pack; default discovers manifest.yaml or .openrig/context-packs")
     .option("--json", "JSON output")
-    .action(async (source: string, opts: { name?: string; json?: boolean }) => {
+    .action(async (source: string, opts: { name?: string; json?: boolean; git?: boolean; checkout?: boolean; pack?: string }) => {
       try {
         // OPR.0.5.9.5 Wave B — config-resolved context library,
         // never a hardcoded ~/.openrig literal; the daemon resolves the same key.
         const targetRoot = new ConfigStore().resolve().context.root;
         let targetDir: string;
-        if (isHttpUrl(source)) {
+        let gitSelection: ReturnType<typeof addGitContext>["selected"] | undefined;
+        if ((opts.pack || opts.checkout) && !opts.git) throw new Error("--pack and --checkout require --git.");
+        if (opts.git) {
+          const gitClient = await getClient();
+          assertLocalGitClient(gitClient);
+          ({ installedAt: targetDir, selected: gitSelection } = addGitContext(source, opts, targetRoot));
+        } else if (isHttpUrl(source)) {
           // R4 — URL install: fetch → validate → atomic stage+rename (no partial pack).
           ({ targetDir } = await installPackFromUrl(source, opts.name, targetRoot));
         } else {
@@ -971,10 +857,14 @@ Examples:
         if (syncError) {
           throw new Error(`Installed at ${targetDir}, but daemon rejected the pack during sync: ${syncError.error}`);
         }
+        if (gitSelection && !syncRes.data.entries.some((entry) => resolve(entry.sourcePath) === resolve(targetDir))) {
+          throw new Error(`Git selection retained at ${targetDir}, but this daemon does not serve it. Check context.root and workspace ref precedence before using it.`);
+        }
         if (opts.json) {
-          console.log(JSON.stringify({ installedAt: targetDir, count: syncRes.data.count }, null, 2));
+          console.log(JSON.stringify({ installedAt: targetDir, count: syncRes.data.count, ...(gitSelection ? { gitSource: gitSelection } : {}) }, null, 2));
         } else {
           console.log(`Installed at ${targetDir}. Library now has ${syncRes.data.count} context pack(s).`);
+          if (gitSelection) console.log(`Git ${gitSelection.revision} from ${gitSelection.checkout}; inspect/update with rig context source.`);
         }
       } catch (err) {
         console.error((err as Error).message);
@@ -982,6 +872,41 @@ Examples:
       }
     });
 
+  const source = cmd.command("source")
+    .description("Inspect Git checkout vs served context, or explicitly fetch/merge and select an update")
+    .addHelpText("after", "\nStart: rig context add <repository-path-or-URL> --git [--pack path]\nEdit/commit in the reported checkout with ordinary Git. Updates never push or reset.\nConflicts retain the old selection; resolve/commit or abort in the checkout before retrying.\nSelection does not prove agent consumption; use context get and check the actual consumer.\n");
+  for (const operation of ["inspect", "update"] as const) {
+    source.command(operation)
+      .argument("<ref>", "Selected Git-backed context pack ref")
+      .description(operation === "inspect"
+        ? "Read local revision, edits, conflicts and selection; no fetch or consumption claim"
+        : "Explicitly fetch/merge the upstream, then select the clean pack; refuse local selection edits")
+      .option("--json", "JSON output")
+      .action(async (ref: string, opts: { json?: boolean }) => {
+        try {
+          const client = await getClient();
+          assertLocalGitClient(client);
+          const entry = await resolvePack(client, ref);
+          const localRoot = new ConfigStore().resolve().context.root;
+          if (resolve(entry.sourcePath) !== resolve(localRoot, entry.relativePath)) throw new Error("This pack is not in the locally configured context library. Run Git source commands on its owning instance.");
+          if (entry.sourceType === "builtin") throw new Error("Builtin context is not a writable Git selection.");
+          const result = operation === "inspect" ? inspectGitContext(entry.sourcePath) : updateGitContext(entry.sourcePath);
+          if (operation === "update") {
+            const sync = await client.post<{ errors?: Array<{ source: string; error: string }>; entries: ContextPackEntryWire[] }>("/api/context-packs/library/sync");
+            if (sync.status !== 200) throw new Error(`Selection updated, but library sync failed (HTTP ${sync.status}); run rig context sync.`);
+            if (!sync.data.entries.some((candidate) => resolve(candidate.sourcePath) === resolve(entry.sourcePath))) throw new Error(`Selection retained, but the daemon cannot serve it: ${sync.data.errors?.map((error) => error.error).join("; ") || "check context root and ref precedence"}`);
+          }
+          // Structured output keeps checkout/selected bytes/consumption distinct
+          // in both terminal and machine use, without a second status renderer.
+          console.log(JSON.stringify(result, null, 2));
+        } catch (err) {
+          const message = (err as Error).message;
+          console.error(opts.json ? JSON.stringify({ error: message }) : message);
+          process.exitCode = 1;
+        }
+      });
+  }
+
   cmd.command("rm")
     .argument("<ref>", "Path-like ref of the context pack to remove (e.g. packs/compaction-restore)")
     .description("Remove a context pack from the library by its path-like ref")

packages/cli/src/commands/crash-cart.ts

@@ -1,7 +1,8 @@
 import { Command } from "commander";
-import { copyFileSync, existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { copyFileSync, lstatSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
+import { ConfigStore } from "../config-store.js";
 
 // `rig crash-cart --json` — the daemon-DOWN recovery verdict emit (plan c015d9ed §C3, coupling ruling
 // option A). Prints ONE JSON = the 3-state detector verdict + (on DOWN) the discovery — READ-ONLY, a
@@ -37,18 +38,24 @@ function openrigHome(): string {
  *  the detector's readDaemonJson omits it). */
 function readDaemonJsonWithDb(home: string): { pid: number; port: number; host?: string; db: string } | undefined {
   const p = join(home, "daemon.json");
-  if (!existsSync(p)) return undefined;
+  if (!existsOrThrow(p)) return undefined;
   try {
     const j = JSON.parse(readFileSync(p, "utf8")) as { pid?: unknown; port?: unknown; host?: unknown; db?: unknown };
     if (typeof j.pid === "number" && typeof j.port === "number" && typeof j.db === "string") {
       return { pid: j.pid, port: j.port, host: typeof j.host === "string" ? j.host : undefined, db: j.db };
     }
-    return undefined;
-  } catch {
-    return undefined;
+    throw new Error("daemon.json has no usable PID, port and database path");
+  } catch (error) {
+    throw new Error(`Cannot read recorded daemon state at ${p}: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
 
+/** Only ENOENT means absent; permissions and dangling links must fail visibly. */
+function existsOrThrow(path: string): boolean {
+  try { lstatSync(path); return true; }
+  catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return false; throw error; }
+}
+
 /**
  * The real verdict: LAZY-imports the narrow @openrig/daemon/crash-cart subpath at invocation (dep
  * rail 2 — rig startup + other verbs never load the daemon module) and composes the shipped detector
@@ -91,7 +98,8 @@ async function realEmit(): Promise<CrashCartEmit> {
         isProcessAlive: cc.isProcessAlive,
         probeHealthz: (url) => probeClassified(url).then((r) => r === "answered"),
         copyFile: copyFileSync,
-        exists: existsSync,
+        exists: existsOrThrow,
+        configuredDbPath: new ConfigStore().resolve().db.path,
         makeScratchDir: () => mkdtempSync(join(tmpdir(), "crash-cart-")),
         removeScratchDir: (d) => rmSync(d, { recursive: true, force: true }),
         openDb: cc.openDaemonDbReadonly,

packages/cli/src/commands/daemon.ts

@@ -1,16 +1,18 @@
 import { Command } from "commander";
 import fs from "node:fs";
+import { randomUUID } from "node:crypto";
+import { acquireDaemonStartLock } from "../daemon-start-lock.js";
 import { execFileSync, spawn } from "node:child_process";
 import { fetchWithTimeout } from "../fetch-with-timeout.js";
 import {
   startDaemon,
   stopDaemon,
   getDaemonStatus,
-  getDaemonUrl,
   readLogs,
   tailLogs,
   type LifecycleDeps,
   OPENRIG_DIR,
+  STATE_FILE,
   resolveBindIntent,
 } from "../daemon-lifecycle.js";
 
@@ -30,6 +32,22 @@ export function createIsProcessAlive(deps: ProcessAliveDeps): (pid: number) => b
   };
 }
 
+type ExecFile = (file: string, args: string[], options: { encoding: "utf-8" }) => string;
+
+// Windows has no ps(1) and no zombie state, so the signal probe alone decides liveness there.
+export function readProcessState(
+  pid: number,
+  platform: NodeJS.Platform = process.platform,
+  run: ExecFile = execFileSync,
+): string | null {
+  if (platform === "win32") return "R";
+  try {
+    return run("ps", ["-o", "state=", "-p", String(pid)], { encoding: "utf-8" });
+  } catch {
+    return null;
+  }
+}
+
 export function realDeps(): LifecycleDeps {
   const isProcessAlive = createIsProcessAlive({
     signalCheck: (pid) => {
@@ -40,16 +58,11 @@ export function realDeps(): LifecycleDeps {
         return false;
       }
     },
-    readProcessState: (pid) => {
-      try {
-        return execFileSync("ps", ["-o", "state=", "-p", String(pid)], { encoding: "utf-8" });
-      } catch {
-        return null;
-      }
-    },
+    readProcessState: (pid) => readProcessState(pid),
   });
 
   return {
+    acquireStartLock: () => acquireDaemonStartLock(OPENRIG_DIR),
     spawn: (cmd, args, opts) => spawn(cmd, args, opts as Parameters<typeof spawn>[2]),
     fetch: async (url) => {
       const res = await fetchWithTimeout(globalThis.fetch, url, {}, {
@@ -62,7 +75,16 @@ export function realDeps(): LifecycleDeps {
     },
     kill: (pid, signal) => { process.kill(pid, signal as NodeJS.Signals); return true; },
     readFile: (p) => { try { return fs.readFileSync(p, "utf-8"); } catch { return null; } },
-    writeFile: (p, content) => fs.writeFileSync(p, content, "utf-8"),
+    writeFile: (p, content) => {
+      if (p !== STATE_FILE) { fs.writeFileSync(p, content, "utf-8"); return; }
+      const temporary = `${p}.${randomUUID()}.tmp`;
+      try {
+        fs.writeFileSync(temporary, content, { encoding: "utf-8", flag: "wx" });
+        fs.renameSync(temporary, p);
+      } finally {
+        try { fs.unlinkSync(temporary); } catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+      }
+    },
     removeFile: (p) => { try { fs.unlinkSync(p); } catch { /* ignore */ } },
     exists: (p) => fs.existsSync(p),
     mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
@@ -77,6 +99,7 @@ export function realDeps(): LifecycleDeps {
       }
     },
     openForAppend: (p) => fs.openSync(p, "a"),
+    closeFile: (fd) => fs.closeSync(fd),
     isProcessAlive,
     // RULING 1ae863d2 — sibling-home scan (home-resolution honesty).
     listDir: (p) => { try { return fs.readdirSync(p); } catch { return []; } },
@@ -90,6 +113,7 @@ export function daemonCommand(depsOverride?: LifecycleDeps): Command {
   cmd
     .command("start")
     .description("Start the daemon")
+    .addHelpText("after", "\nStartup reserves this local instance before initialization and verifies the spawned child PID on every required listener.\nMissing/mismatched identity or child exit fails startup; failed publication withdraws only this launch's matching state. Use a matching CLI/daemon installation.\nA concurrent start fails without spawning another child. Inspect daemon-start.lock for launcher/child PIDs after an interrupted start;\nonly archive an abandoned reservation after proving both processes absent. A failed cleanup retains it and reports the child PID.\n")
     .option("--port <port>", "Port to listen on")
     .option("--host <host>", "Host to bind on")
     .option("--db <path>", "Database path")
@@ -215,30 +239,12 @@ export function daemonCommand(depsOverride?: LifecycleDeps): Command {
 
   cmd
     .command("stop")
-    .description("Stop the daemon")
+    .description("Stop the daemon (10s shutdown budget; 12s process wait; incomplete drain exits nonzero)")
+    .addHelpText("after", "\nSends at most one SIGTERM to a live target and verifies the original PID and listener. Repeated signals join shutdown.\nFor a recorded target, missing/stale receipts and incomplete drains exit nonzero, including retries.\nTarget state is retained until a matching clean receipt; status reads preserve unverified state.\nNo target is a distinct no-op, never clean-drain certification; unbound incomplete evidence stays unverified.\nInspect OPENRIG_HOME/daemon-shutdown.json and daemon.log for the phase and outcome.\nThe bound covers asynchronous shutdown; an event-loop wedge still requires operator recovery.\n")
     .action(async () => {
       try {
-        const deps = getDeps();
-        let stopError: unknown;
-        try {
-          await stopDaemon(deps);
-        } catch (err) {
-          stopError = err;
-        }
-        const status = await getDaemonStatus(deps);
-        if (status.state !== "stopped" && status.state !== "stale") {
-          const configuredTarget = process.env.OPENRIG_URL || process.env.RIGGED_URL;
-          const target = configuredTarget?.replace(/\/+$/, "")
-            ?? (status.port !== undefined ? getDaemonUrl(status) : "the daemon selected by the active OpenRig configuration");
-          const check = `${target}/healthz`;
-          const stopCause = stopError instanceof Error ? ` Stop request reported: ${stopError.message}` : "";
-          if (status.state === "running") {
-            throw new Error(`Daemon stop verification failed: targeted ${target}; checked ${check}; the daemon is still listening.${stopCause}`);
-          }
-          throw new Error(`Daemon stop verification was inconclusive: targeted ${target}; checked ${check}; verified-down evidence was not observed (state=${status.state}).${stopCause}`);
-        }
-        if (stopError) throw stopError;
-        console.log("Daemon stopped");
+        const outcome = await stopDaemon(getDeps());
+        console.log(outcome === "stopped" ? "Daemon stopped" : "No daemon target recorded; listener refused. Nothing to stop; prior drain not certified.");
       } catch (err) {
         console.error(err instanceof Error ? err.message : String(err));
         process.exitCode = 1;
@@ -279,7 +285,7 @@ export function daemonCommand(depsOverride?: LifecycleDeps): Command {
           console.log("Daemon stopped");
           break;
         case "stale":
-          console.log("Daemon stale (cleaned up)");
+          console.log("Daemon PID is absent (stale state)");
           break;
         case "unverified":
           // 1ae863d2 — C3 semantics: we could NOT confirm up or down; never claim stopped.

packages/cli/src/commands/destroy.ts

@@ -70,7 +70,7 @@ function resolveRuntimeConfig(configStore: Pick<ConfigStore, "resolve">): Resolv
 function realDestroyDeps(): DestroyDeps {
   const lifecycleDeps = realDeps();
   return {
-    stopDaemon: async () => stopDaemon(lifecycleDeps),
+    stopDaemon: async () => { await stopDaemon(lifecycleDeps); },
     inspectListener: async (host: string, port: number): Promise<ListenerInspection> => {
       try {
         const res = await fetch(`http://${host}:${port}/healthz`);

packages/cli/src/commands/doctor.ts

@@ -15,6 +15,7 @@ import {
 import { buildTmuxControlFailure, probeTmuxControl } from "../tmux-health.js";
 import { parse as parseYaml } from "yaml";
 import { compareSpecToLive, topologyFromRigSpec, topologyFromLiveLogicalIds } from "@openrig/daemon/spec-conformance";
+import { classifyNodeVersion } from "../node-support.js";
 
 interface DoctorCheck {
   name: string;
@@ -48,7 +49,6 @@ export interface DoctorDeps {
   fetchLiveLogicalIds?: (rigName: string) => Promise<string[] | null>;
 }
 
-const MIN_NODE_MAJOR = 20;
 const DEFAULT_PORT = 7433;
 
 function defaultCheckPort(port: number, host: string): Promise<boolean> {
@@ -96,16 +96,18 @@ export function runDoctorChecks(deps: DoctorDeps): { checks: DoctorCheck[]; port
   }
 
   // 3. Node version
-  const major = parseInt(process.version.replace(/^v/, ""), 10);
-  if (major >= MIN_NODE_MAJOR) {
+  const nodeSupport = classifyNodeVersion(process.version);
+  if (nodeSupport.kind === "supported") {
     checks.push({ name: "node_version", status: "pass", message: `Node ${process.version}` });
+  } else if (nodeSupport.kind === "untested") {
+    checks.push({ name: "node_version", status: "warn", message: nodeSupport.message! });
   } else {
     checks.push({
       name: "node_version",
       status: "fail",
-      message: `Node ${process.version} is below minimum (v${MIN_NODE_MAJOR}).`,
-      reason: "OpenRig requires Node 20+ for built-in fetch, ESM, and stable API support.",
-      fix: "Install Node 20+ via nvm, fnm, or your package manager.",
+      message: nodeSupport.message!,
+      reason: nodeSupport.reason,
+      fix: nodeSupport.fix,
     });
   }
 

packages/cli/src/commands/env.ts

@@ -58,6 +58,12 @@ Examples:
       }
 
       const receipt = res.data["receipt"] as Record<string, unknown> | null;
+      const probeStatus = res.data["probeStatus"];
+      if (probeStatus === "stale" || probeStatus === "no_orchestrator") {
+        const probeError = res.data["probeError"];
+        console.error(`Service status is ${probeStatus === "stale" ? "stale" : "unverified"} (probe: ${probeStatus}); ${receipt ? "showing the saved receipt" : "no saved receipt is available"}.${typeof probeError === "string" && probeError ? ` ${probeError}` : ""}`);
+      }
+
       if (!receipt) {
         console.log("Services configured but no receipt available yet.");
         return;

packages/cli/src/commands/gateway.ts

@@ -1,4 +1,5 @@
 import { Command } from "commander";
+import { resolveSenderSession, SENDER_FALLBACK } from "../sender-identity.js";
 // The human registry is home-state owned by the daemon; the verb LAZY-imports the narrow
 // @openrig/daemon/gateway-human-registry surface at invocation (the C3/crash-cart dep rail —
 // one source, no twin). Type-only import keeps the surface off the eager cli graph.
@@ -29,6 +30,56 @@ export type HumanRowsLookup = (address: string) => Promise<
 
 export interface GatewayCommandDeps {
   queueRows?: HumanRowsLookup;
+  humanReadiness?: HumanReadinessLookup;
+}
+
+export interface HumanReadinessView {
+  state: "ready" | "not-ready" | "indeterminate";
+  configured: boolean | null;
+  enabled: boolean | null;
+  active: boolean | null;
+  ready: boolean;
+  connector?: { kind: string; ref: string };
+  reason: string;
+  nextAction: string | null;
+  checkedAt?: string;
+}
+
+export type HumanReadinessLookup = (entityId: string) => Promise<HumanReadinessView>;
+
+export async function daemonHumanReadiness(entityId: string): Promise<HumanReadinessView> {
+  try {
+    const { DaemonClient } = await import("../client.js");
+    const response = await new DaemonClient().get<{ ok?: boolean; readiness?: HumanReadinessView; error?: unknown; message?: unknown }>(
+      `/api/gateway/human/${encodeURIComponent(entityId)}/readiness`,
+    );
+    if (response.status !== 200) {
+      const detail = [response.data?.error, response.data?.message].filter((value) => typeof value === "string").join(": ");
+      throw new Error(`HTTP ${response.status}: ${detail || "readiness request refused"}`);
+    }
+    const readiness = response.data?.readiness;
+    if (response.data?.ok !== true || !readiness
+      || !["ready", "not-ready", "indeterminate"].includes(readiness.state)
+      || [readiness.configured, readiness.enabled, readiness.active].some((value) => value !== null && typeof value !== "boolean")
+      || readiness.ready !== (readiness.state === "ready")
+      || typeof readiness.reason !== "string" || !readiness.reason.trim()
+      || (readiness.nextAction !== null && typeof readiness.nextAction !== "string")
+      || (readiness.connector !== undefined && (!readiness.connector || typeof readiness.connector.kind !== "string" || typeof readiness.connector.ref !== "string"))
+      || (readiness.checkedAt !== undefined && typeof readiness.checkedAt !== "string")) {
+      throw new Error("HTTP 200: malformed delivery readiness response");
+    }
+    return readiness;
+  } catch (error) {
+    return {
+      state: "indeterminate",
+      configured: null,
+      enabled: null,
+      active: null,
+      ready: false,
+      reason: `delivery readiness could not be read from the daemon: ${(error as Error).message}`,
+      nextAction: "rig status",
+    };
+  }
 }
 
 /** Default queue-row half of the remove guard: non-terminal rows addressed to the human,
@@ -67,6 +118,7 @@ export async function daemonQueueRows(address: string): ReturnType<HumanRowsLook
 
 export function gatewayCommand(deps: GatewayCommandDeps = {}): Command {
   const queueRows: HumanRowsLookup = deps.queueRows ?? daemonQueueRows;
+  const humanReadiness: HumanReadinessLookup = deps.humanReadiness ?? daemonHumanReadiness;
   const cmd = new Command("gateway").description("Gateway: the human registry + connector surfaces");
   const human = cmd.command("human").description("Manage human specs (file-per-human fragments under gateway/humans/)");
 
@@ -82,7 +134,9 @@ export function gatewayCommand(deps: GatewayCommandDeps = {}): Command {
     .requiredOption("--delivery-class <A|B|C|D>", "Notification loudness class (the notifications register selection)")
     .option("--away", "Set the AWAY preset")
     .option("--replace", "Explicitly replace an existing human (no silent overwrite)")
-    .action(async (entityId: string, opts: { displayName: string; binding: string[]; deliveryClass: string; away?: boolean; replace?: boolean }) => {
+    .option("--reason <reason>", "Reason recorded with connector binding changes", "register human delivery")
+    .option("--actor <actor>", "Named operator when outside a managed seat")
+    .action(async (entityId: string, opts: { displayName: string; binding: string[]; deliveryClass: string; away?: boolean; replace?: boolean; reason: string; actor?: string }) => {
       // LAZY import the narrow daemon surface at invocation (dep rail 2).
       const registry = await import("@openrig/daemon/gateway-human-registry");
       const { addHumanFragment, parseBindingSpec } = registry as unknown as {
@@ -122,9 +176,21 @@ export function gatewayCommand(deps: GatewayCommandDeps = {}): Command {
         connectorBindings: bindings,
         prefs: { deliveryClass: opts.deliveryClass, ...(opts.away ? { away: true } : {}) },
       };
-      const res = addHumanFragment(fragment, undefined, { replace: !!opts.replace });
-      if (!res.ok) { console.error(`refused: ${res.error}`); process.exitCode = 1; return; }
-      console.log(JSON.stringify({ ok: true, entityId: res.fragment.entityId, path: res.path }));
+      const before = registry.showHuman(entityId);
+      try {
+        const result = await registry.runChannelOperation({
+          actor: resolveSenderSession() ?? opts.actor ?? SENDER_FALLBACK, provenance: "claimed:v1", reason: opts.reason,
+          action: "binding", subject: `${entityId}@external`,
+          before: { digest: registry.channelStateDigest(before.ok ? before.record.connectorBindings.map(({ inboundResolvable: _derived, ...binding }) => binding) : null) },
+          run: async () => {
+            const res = addHumanFragment(fragment, undefined, { replace: !!opts.replace });
+            if (!res.ok) throw new Error(res.error);
+            const digest = registry.channelStateDigest(res.fragment.connectorBindings);
+            return { value: res, after: { digest }, effect: before.ok && registry.channelStateDigest(before.record.connectorBindings.map(({ inboundResolvable: _derived, ...binding }) => binding)) === digest ? "no-op" : "applied" };
+          },
+        });
+        console.log(JSON.stringify({ ok: true, entityId, path: result.value.path, receipt: result.receipt }));
+      } catch (error) { console.error(`refused: ${(error as Error).message}`); process.exitCode = 1; }
     });
 
   // ── S12 (OPR.0.5.5.12): the fragment lifecycle beyond add. Every verb operates through
@@ -138,11 +204,13 @@ export function gatewayCommand(deps: GatewayCommandDeps = {}): Command {
       const { listHumans } = await import("@openrig/daemon/gateway-human-registry");
       const res = listHumans();
       if (!res.ok) { console.error(`refused: ${res.error}`); process.exitCode = 1; return; }
-      if (opts.json) { console.log(JSON.stringify({ ok: true, humans: res.humans, ...(res.advisory ? { advisory: res.advisory } : {}) })); return; }
+      const humans = await Promise.all(res.humans.map(async (record) => ({ ...record, deliveryReadiness: await humanReadiness(record.entityId) })));
+      if (opts.json) { console.log(JSON.stringify({ ok: true, humans, ...(res.advisory ? { advisory: res.advisory } : {}) })); return; }
       if (res.humans.length === 0) { console.log("no human configured yet — register one: rig gateway human add <entityId> --display-name … --binding … --delivery-class …"); return; }
-      for (const h of res.humans) {
+      for (const h of humans) {
         const inbound = h.bindings.inboundResolvable ? "" : "  [outbound-only]";
-        console.log(`${h.entityId}  "${h.displayName}"  class=${h.deliveryClass}  ${h.away ? "away" : "available"}  bindings=${h.bindings.count} (primary ${h.bindings.primary.kind}:${h.bindings.primary.connectorRef})${inbound}`);
+        console.log(`${h.entityId}  "${h.displayName}"  class=${h.deliveryClass}  ${h.away ? "away" : "available"}  bindings=${h.bindings.count} (primary ${h.bindings.primary.kind}:${h.bindings.primary.connectorRef})  delivery=${h.deliveryReadiness.state}${inbound}`);
+        if (!h.deliveryReadiness.ready) console.log(`  delivery: ${h.deliveryReadiness.reason}${h.deliveryReadiness.nextAction ? `; next: ${h.deliveryReadiness.nextAction}` : ""}`);
       }
       if (res.advisory) console.log(`advisory: ${res.advisory}`);
     });
@@ -155,8 +223,8 @@ export function gatewayCommand(deps: GatewayCommandDeps = {}): Command {
       const { showHuman } = await import("@openrig/daemon/gateway-human-registry");
       const res = showHuman(entityId);
       if (!res.ok) { console.error(`refused: ${res.error}`); process.exitCode = 1; return; }
-      if (opts.json) { console.log(JSON.stringify({ ok: true, record: res.record })); return; }
-      const r = res.record;
+      const r = { ...res.record, deliveryReadiness: await humanReadiness(entityId) };
+      if (opts.json) { console.log(JSON.stringify({ ok: true, record: r })); return; }
       console.log(`${r.entityId} (${r.address}) — "${r.displayName}"`);
       console.log(`  fragment: ${r.fragmentPath}`);
       console.log(`  delivery-class: ${r.prefs.deliveryClass.value} (${r.prefs.deliveryClass.source})`);
@@ -164,14 +232,37 @@ export function gatewayCommand(deps: GatewayCommandDeps = {}): Command {
       r.connectorBindings.forEach((b, i) => {
         console.log(`  binding.${i}: ${b.kind}:${b.connectorRef} role=${b.role}${b.handle ? ` handle=${b.handle}` : " [outbound-only]"}`);
       });
+      console.log(`  delivery-readiness: ${r.deliveryReadiness.state} (${r.deliveryReadiness.reason})`);
+      if (r.deliveryReadiness.nextAction) console.log(`  next: ${r.deliveryReadiness.nextAction}`);
     });
 
   human
     .command("set <entityId> <field> <value>")
     .description("Edit one field through the verb (same validation as add; re-projection immediate). Fields: display-name, delivery-class, away, binding.<n>")
-    .action(async (entityId: string, field: string, value: string) => {
-      const { setHumanField } = await import("@openrig/daemon/gateway-human-registry");
-      const res = setHumanField(entityId, field, value);
+    .option("--reason <reason>", "Reason recorded with connector binding changes", "update human binding")
+    .option("--actor <actor>", "Named operator when outside a managed seat")
+    .action(async (entityId: string, field: string, value: string, opts: { reason: string; actor?: string }) => {
+      const registry = await import("@openrig/daemon/gateway-human-registry");
+      if (field.startsWith("binding.")) {
+        const before = registry.showHuman(entityId);
+        if (!before.ok) { console.error(`refused: ${before.error}`); process.exitCode = 1; return; }
+        try {
+          const prior = registry.channelStateDigest(before.record.connectorBindings.map(({ inboundResolvable: _derived, ...binding }) => binding));
+          const result = await registry.runChannelOperation({
+            actor: resolveSenderSession() ?? opts.actor ?? SENDER_FALLBACK, provenance: "claimed:v1", reason: opts.reason,
+            action: "binding", subject: `${entityId}@external`, before: { digest: prior },
+            run: async () => {
+              const res = registry.setHumanField(entityId, field, value);
+              if (!res.ok) throw new Error(res.error);
+              const digest = registry.channelStateDigest(res.fragment.connectorBindings);
+              return { value: res, after: { digest }, effect: digest === prior ? "no-op" : "applied" };
+            },
+          });
+          console.log(JSON.stringify({ ok: true, entityId, field, path: result.value.path, receipt: result.receipt }));
+        } catch (error) { console.error(`refused: ${(error as Error).message}`); process.exitCode = 1; }
+        return;
+      }
+      const res = registry.setHumanField(entityId, field, value);
       if (!res.ok) { console.error(`refused: ${res.error}`); process.exitCode = 1; return; }
       console.log(JSON.stringify({ ok: true, entityId: res.fragment.entityId, field, path: res.path }));
     });

packages/cli/src/commands/health.ts

@@ -0,0 +1,467 @@
+import { readFileSync } from "node:fs";
+import { Command, InvalidArgumentError, Option } from "commander";
+import {
+  HEALTH_SEVERITIES,
+  HEALTH_STATUSES,
+  type HealthRecord,
+  type HealthScope,
+} from "@openrig/daemon/health-projection";
+import type { HealthListProjection } from "@openrig/daemon/health-detectors";
+import {
+  DaemonClient,
+  DaemonConnectionError,
+  DaemonResponseError,
+  DaemonTimeoutError,
+} from "../client.js";
+import {
+  getDaemonStatus,
+  getDaemonUrl,
+  statusGuardMessage,
+} from "../daemon-lifecycle.js";
+import { realDeps } from "./daemon.js";
+import { resolveIdentitySource } from "./whoami.js";
+import type { StatusDeps } from "./status.js";
+import { shellQuote } from "../cross-host-executor.js";
+import { omittedReadField, readView } from "../read-view.js";
+
+interface DiagnosisEntry {
+  row: Record<string, unknown> & { qitemId: string };
+  finding: HealthRecord;
+  packet: Record<string, unknown> & { instructions: string };
+  receipts: unknown[];
+  authority: Array<{ path: string; state: string; content?: string; role?: string; reason?: string; selectedBy?: string }>;
+  disposition: { verdict: string; causalStart: string | null; steering: string; uncertainty: string; evidenceRefs: string[];
+    correction?: { applicability: string; causalJudgment: string; action: { state: string; summary: string }; effect: { state: string; summary: string } } } | null;
+  assessment?: { actor?: string; at: string } | null;
+  behavioralEffect?: string;
+  guidance?: string;
+  humanDelivery: { qitemId: string; outcome: string } | null;
+  notificationReadiness?: { ready: boolean; reason: string } | null;
+}
+
+function diagnosisPreview(entry: DiagnosisEntry) {
+  const omitted: ReturnType<typeof omittedReadField>[] = [];
+  // ponytail: omit only known evidence payloads; keep current decisions and unknowns intact.
+  function without<T extends object>(record: T, keys: string[], prefix = ""): T {
+    const copy = { ...record } as Record<string, unknown>;
+    for (const key of keys) {
+      const value = copy[key];
+      if (value === undefined || value === null || value === "" || (Array.isArray(value) && !value.length)) continue;
+      omitted.push(omittedReadField(`${prefix}${key}`, value));
+      delete copy[key];
+    }
+    return copy as T;
+  }
+  const result = without(entry, ["receipts", "guidance"]);
+  result.row = without(entry.row, ["body", "chainOfRecord"], "row.");
+  result.packet = without(entry.packet, ["finding", "authority", "instructions"], "packet.");
+  result.finding = without(entry.finding, ["evidence"], "finding.");
+  if (entry.finding.ceremony) {
+    result.finding.ceremony = { ...entry.finding.ceremony,
+      workflowReceipts: entry.finding.ceremony.workflowReceipts.map((receipt, index) => {
+        const envelope = without(receipt, ["evidence"], `finding.ceremony.workflowReceipts[${index}].`);
+        const evidence = receipt.evidence;
+        // These are the existing cut/acceptance identity spellings, not a verdict on the receipt.
+        const identity = evidence && typeof evidence === "object" && !Array.isArray(evidence)
+          ? Object.fromEntries(Object.entries(evidence).filter(([key, value]) =>
+            ["candidate", "candidateSha", "candidate_sha", "cutSha", "tree", "verdict", "evidenceRef", "evidence_ref"].includes(key)
+            && typeof value === "string"))
+          : {};
+        return { ...envelope, evidenceIdentity: identity };
+      }),
+    };
+  }
+  result.authority = entry.authority.map((ref, index) => without(ref, ["content"], `authority[${index}].`));
+  return { ...result, readView: readView(entry, `rig health diagnosis show ${shellQuote(entry.row.qitemId)} --full --json`, omitted) };
+}
+
+const HEALTH_ERROR_SCHEMA = "openrig.health-error/v0alpha1" as const;
+
+type IdentitySource = { nodeId?: string; sessionName?: string };
+
+export interface HealthDeps extends StatusDeps {
+  resolveIdentity: () => IdentitySource | null;
+}
+
+interface HealthListOptions {
+  self?: boolean;
+  seat?: string;
+  rig?: string;
+  instance?: string | boolean;
+  severity?: string;
+  status?: string;
+  limit?: number;
+  json?: boolean;
+}
+
+interface HealthCliError {
+  schema: typeof HEALTH_ERROR_SCHEMA;
+  error: string;
+  message: string;
+  nextInspection: string;
+  details?: unknown;
+}
+
+function defaultDeps(): HealthDeps {
+  return {
+    lifecycleDeps: realDeps(),
+    clientFactory: (baseUrl: string) => new DaemonClient(baseUrl),
+    resolveIdentity: () => resolveIdentitySource({}),
+  };
+}
+
+function parseLimit(value: string): number {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1 || parsed > 200) {
+    throw new InvalidArgumentError("must be an integer from 1 to 200");
+  }
+  return parsed;
+}
+
+function emitError(error: HealthCliError, json: boolean): void {
+  if (json) {
+    console.log(JSON.stringify(error));
+  } else {
+    console.error(`Error: ${error.message}`);
+    console.error(`  Next inspection: ${error.nextInspection}`);
+  }
+  process.exitCode = 1;
+}
+
+function daemonError(details: unknown): HealthCliError {
+  return {
+    schema: HEALTH_ERROR_SCHEMA,
+    error: "health_daemon_unavailable",
+    message: "The health projection could not be read because the daemon did not respond.",
+    nextInspection: "rig daemon status",
+    details,
+  };
+}
+
+function responseError(status: number, data: unknown): HealthCliError {
+  const daemonCode = typeof data === "object" && data !== null && typeof (data as { error?: unknown }).error === "string"
+    ? (data as { error: string }).error
+    : null;
+  if (status === 503 && daemonCode === "health_projection_unavailable") {
+    return {
+      schema: HEALTH_ERROR_SCHEMA,
+      error: daemonCode,
+      message: "The daemon is reachable, but its health projection is unavailable.",
+      nextInspection: "rig daemon status",
+    };
+  }
+  if (status === 404 && daemonCode === "health_finding_not_found") {
+    return {
+      schema: HEALTH_ERROR_SCHEMA,
+      error: daemonCode,
+      message: "No health finding exists with that ID in the current projection.",
+      nextInspection: "rig health --instance --json",
+    };
+  }
+  if (status === 404 && daemonCode === "not_found") {
+    return {
+      schema: HEALTH_ERROR_SCHEMA,
+      error: "health_projection_unavailable",
+      message: "The daemon is reachable, but it does not expose the health projection.",
+      nextInspection: "rig --version",
+      details: data,
+    };
+  }
+  return {
+    schema: HEALTH_ERROR_SCHEMA,
+    error: "health_query_failed",
+    message: `The daemon rejected the health query (HTTP ${status}).`,
+    nextInspection: "rig health --help",
+    details: data,
+  };
+}
+
+async function readyClient(deps: HealthDeps, json: boolean): Promise<DaemonClient | null> {
+  const status = await getDaemonStatus(deps.lifecycleDeps, { cleanupStaleState: false });
+  if (status.state !== "running" || status.healthy === false) {
+    emitError(daemonError(statusGuardMessage(status)), json);
+    return null;
+  }
+  return deps.clientFactory(getDaemonUrl(status));
+}
+
+async function readSelfSeatId(client: DaemonClient, deps: HealthDeps, json: boolean): Promise<string | null> {
+  const source = deps.resolveIdentity();
+  if (!source) {
+    emitError({
+      schema: HEALTH_ERROR_SCHEMA,
+      error: "health_identity_unavailable",
+      message: "The current seat identity is unavailable, so self health cannot be scoped safely.",
+      nextInspection: "rig whoami --json",
+    }, json);
+    return null;
+  }
+
+  const params = new URLSearchParams();
+  if (source.nodeId) params.set("nodeId", source.nodeId);
+  else if (source.sessionName) params.set("sessionName", source.sessionName);
+  params.set("compact", "1");
+  const response = await client.get<Record<string, unknown>>(`/api/whoami?${params.toString()}`);
+  if (response.status === 409) {
+    emitError({
+      schema: HEALTH_ERROR_SCHEMA,
+      error: "health_identity_ambiguous",
+      message: "More than one managed seat matches the current identity.",
+      nextInspection: "rig ps --nodes -A",
+      details: response.data,
+    }, json);
+    return null;
+  }
+  if (response.status >= 400) {
+    emitError({
+      schema: HEALTH_ERROR_SCHEMA,
+      error: "health_identity_unavailable",
+      message: "The daemon could not resolve the current seat identity.",
+      nextInspection: "rig whoami --json",
+      details: response.data,
+    }, json);
+    return null;
+  }
+  const identity = response.data["identity"];
+  const nodeId = typeof identity === "object" && identity !== null
+    ? (identity as Record<string, unknown>)["nodeId"]
+    : null;
+  if (typeof nodeId !== "string" || nodeId.length === 0) {
+    emitError({
+      schema: HEALTH_ERROR_SCHEMA,
+      error: "health_identity_indeterminate",
+      message: "The identity response did not carry a stable node ID, so self health is indeterminate.",
+      nextInspection: "rig whoami --full --json",
+      details: response.data,
+    }, json);
+    return null;
+  }
+  return nodeId;
+}
+
+function scopeLabel(scope: HealthScope): string {
+  switch (scope.type) {
+    case "instance": return `instance:${scope.instanceId}`;
+    case "rig": return `rig:${scope.rigId}`;
+    case "seat": return `seat:${scope.seatId}`;
+    case "mission": return `mission:${scope.missionId}`;
+    case "slice": return `slice:${scope.sliceId}`;
+  }
+}
+
+function renderList(projection: HealthListProjection): void {
+  const evaluated = projection.evaluatedAt ?? "unavailable";
+  console.log(`Fleet health — evaluated=${evaluated} findings=${projection.total} limit=${projection.limit}`);
+  if (projection.records.length === 0) {
+    console.log("No health findings match this bounded query. This is not a healthy assertion.");
+    console.log("Next inspection: widen only as needed with `rig health --instance --json`.");
+    return;
+  }
+  for (const record of projection.records) {
+    console.log(`${record.id}  ${record.severity}  ${record.status}  ${record.detector}`);
+    console.log(`  ${scopeLabel(record.scope)}  ${record.confidence} confidence  freshness=${record.freshness.state}${record.indeterminateReason ? `  indeterminate=${record.indeterminateReason}` : ""}`);
+    console.log(`  ${record.summary}`);
+    if (record.operatingPosture) console.log(`  Operating posture: ${record.operatingPosture.posture} (${record.operatingPosture.source}); phase=${record.operatingPosture.context?.phase.value ?? "unknown"}`);
+  }
+  if (projection.truncated) {
+    console.log(`Truncated at ${projection.limit} of ${projection.total}; narrow the scope or raise --limit (maximum 200).`);
+  }
+}
+
+function renderExplanation(record: HealthRecord): void {
+  console.log(`Health finding ${record.id}`);
+  console.log(`  Detector:    ${record.detector} (${record.category})`);
+  console.log(`  Scope:       ${scopeLabel(record.scope)}`);
+  console.log(`  Outcome:     ${record.severity} / ${record.status} / ${record.confidence} confidence`);
+  console.log(`  Observed:    ${record.startedAt ?? "unavailable"} → ${record.lastObservedAt ?? "unavailable"}`);
+  console.log(`  Window:      ${record.window.startedAt} → ${record.window.endedAt}; source=${record.window.source}; limit=${record.window.limit}; retention=${record.window.retentionSeconds}s`);
+  console.log(`  Freshness:   ${record.freshness.state}; evaluated=${record.freshness.evaluatedAt}; newest=${record.freshness.newestSourceAt ?? "unavailable"}; max-age=${record.freshness.maxAgeSeconds}s; age=${record.freshness.ageSeconds ?? "unavailable"}s`);
+  if (record.indeterminateReason) console.log(`  Indeterminate: ${record.indeterminateReason}`);
+  console.log(`  Rule:        ${record.threshold}`);
+  console.log(`  Policy:      ${record.policyVersion ?? "not reported by source"}`);
+  if (record.operatingPosture) console.log(`  Posture:     ${JSON.stringify(record.operatingPosture)}`);
+  console.log(`  Explanation: ${record.explanation}`);
+  console.log(`  Evidence:    ${JSON.stringify(record.evidence)}`);
+  if (record.ceremony) console.log(`  Diagnosis stage: ${record.ceremony.stage}\n  Normal context: ${JSON.stringify(record.ceremony)}`);
+  console.log(`  Inspect:     ${record.suggestedInspection}`);
+}
+
+async function guardedRequest<T>(
+  request: () => Promise<{ status: number; data: T }>,
+  json: boolean,
+): Promise<{ status: number; data: T } | null> {
+  try {
+    return await request();
+  } catch (error) {
+    const details = error instanceof DaemonTimeoutError
+      ? { kind: "timeout", message: error.message }
+      : error instanceof DaemonResponseError
+        ? { kind: "unreadable-response", status: error.status, bodySnippet: error.bodySnippet }
+        : error instanceof DaemonConnectionError
+          ? { kind: "connection", message: error.message }
+          : { kind: "unexpected", message: error instanceof Error ? error.message : String(error) };
+    emitError(daemonError(details), json);
+    return null;
+  }
+}
+
+export function healthCommand(depsOverride?: HealthDeps): Command {
+  const deps = depsOverride ?? defaultDeps();
+  const command = new Command("health")
+    .description("Inspect read-only, explainable system health records")
+    .addOption(new Option("--self", "Inspect the current seat (default)").conflicts(["seat", "rig", "instance"]))
+    .addOption(new Option("--seat <node-id>", "Inspect one seat by stable node ID").conflicts(["self", "rig", "instance"]))
+    .addOption(new Option("--rig <rig-id>", "Inspect findings whose canonical scope is this rig").conflicts(["self", "seat", "instance"]))
+    .addOption(new Option("--instance [instance-id]", "Inspect the whole local instance, or one canonical instance scope by ID").conflicts(["self", "seat", "rig"]))
+    .addOption(new Option("--severity <severity>", "Filter by severity").choices([...HEALTH_SEVERITIES]))
+    .addOption(new Option("--status <status>", "Filter by finding status").choices([...HEALTH_STATUSES]))
+    .option("--limit <count>", "Maximum findings (1-200)", parseLimit, 100)
+    .option("--json", "JSON output; diagnosis list/show need --full for complete evidence")
+    .option("--actor <name>", "Attribute explicit diagnosis writes when operating outside a managed seat")
+    .addHelpText("after", `
+The default scope is the current seat. --instance without an ID is the bounded
+instance-wide projection. Empty output is not a healthy assertion. This command
+list/explain never mutate. Diagnosis mutations use explicit subcommands; automatic diagnostic presentation is opt-in policy.`);
+
+  command.action(async (options: HealthListOptions) => {
+    const json = Boolean(options.json);
+    const client = await readyClient(deps, json);
+    if (!client) return;
+
+    let scopeType: HealthScope["type"] | undefined;
+    let scopeId: string | undefined;
+    if (options.seat) {
+      scopeType = "seat";
+      scopeId = options.seat;
+    } else if (options.rig) {
+      scopeType = "rig";
+      scopeId = options.rig;
+    } else if (typeof options.instance === "string") {
+      scopeType = "instance";
+      scopeId = options.instance;
+    } else if (!options.instance) {
+      const seatId = await guardedRequest(
+        () => readSelfSeatId(client, deps, json).then((data) => ({ status: data === null ? 1 : 0, data })),
+        json,
+      );
+      if (!seatId || seatId.data === null) return;
+      scopeType = "seat";
+      scopeId = seatId.data;
+    }
+
+    const params = new URLSearchParams();
+    if (scopeType && scopeId) {
+      params.set("scope_type", scopeType);
+      params.set("scope_id", scopeId);
+    }
+    params.set("limit", String(options.limit ?? 100));
+    if (options.severity) params.set("severity", options.severity);
+    if (options.status) params.set("status", options.status);
+    const response = await guardedRequest(
+      () => client.get<HealthListProjection>(`/api/health?${params.toString()}`),
+      json,
+    );
+    if (!response) return;
+    if (response.status >= 400) {
+      emitError(responseError(response.status, response.data), json);
+      return;
+    }
+    if (json) console.log(JSON.stringify(response.data));
+    else renderList(response.data);
+  });
+
+  command
+    .command("explain <finding-id>")
+    .description("Explain one health finding from its canonical bounded record")
+    .option("--json", "Emit the canonical daemon health record as JSON")
+    .action(async (findingId: string, options: { json?: boolean }) => {
+      const json = Boolean(options.json || command.opts().json);
+      const client = await readyClient(deps, json);
+      if (!client) return;
+      const response = await guardedRequest(
+        () => client.get<HealthRecord>(`/api/health/${encodeURIComponent(findingId)}`),
+        json,
+      );
+      if (!response) return;
+      if (response.status >= 400) {
+        emitError(responseError(response.status, response.data), json);
+        return;
+      }
+      if (json) console.log(JSON.stringify(response.data));
+      else renderExplanation(response.data);
+    });
+
+  async function diagnosisRequest(path: string, options: { json?: boolean; full?: boolean }, payload?: unknown) {
+    const json = Boolean(options.json || command.opts().json);
+    const client = await readyClient(deps, json);
+    if (!client) return;
+    const response = await guardedRequest(() => payload === undefined ? client.get(`/api/health-diagnosis${path}`) : client.post(`/api/health-diagnosis${path}`, { ...(payload as object), actor: command.opts().actor }), json);
+    if (!response) return;
+    if (response.status >= 400) { console.error(JSON.stringify(response.data)); process.exitCode = 1; return; }
+    const occurrenceRead = payload === undefined && path !== "/policy" && path !== "/checkpoints";
+    if (options.full || json || path === "/policy" || path === "/checkpoints" || path === "/evaluate" || path.endsWith("/notify")) {
+      const data = occurrenceRead && !options.full
+        ? (Array.isArray(response.data) ? response.data.map((entry) => diagnosisPreview(entry as DiagnosisEntry)) : diagnosisPreview(response.data as DiagnosisEntry))
+        : response.data;
+      console.log(JSON.stringify(data, null, json ? undefined : 2));
+    } else {
+      const entries = Array.isArray(response.data) ? response.data : [response.data];
+      if (!entries.length) console.log("No diagnostic occurrences. This is not a healthy assertion.");
+      for (const entry of entries as DiagnosisEntry[]) {
+        console.log(`${entry.row.qitemId}  ${entry.finding.status}  ${entry.finding.detector}`);
+        console.log(`  Disposition: ${entry.disposition?.verdict ?? "awaiting agent investigation"}`);
+        if (path) {
+          console.log(`  Queue: ${entry.row.state ?? "unknown"}  Owner: ${entry.row.destinationSession ?? "unknown"}  Blocker: ${entry.row.blockedOn ?? "none recorded"}`);
+          if (entry.notificationReadiness) console.log(`  Human readiness: ${entry.notificationReadiness.ready ? "ready" : "unavailable"} — ${entry.notificationReadiness.reason}`);
+          if (entry.humanDelivery) console.log(`  Human delivery: ${entry.humanDelivery.outcome} (${entry.humanDelivery.qitemId})`);
+          console.log(`  Finding: ${entry.finding.id}  Policy: ${entry.finding.policyVersion ?? "unreported"}`);
+          console.log(`  ${entry.finding.explanation}`);
+          if (entry.finding.operatingPosture) console.log(`  Posture: ${entry.finding.operatingPosture.posture} (${entry.finding.operatingPosture.source}); phase=${entry.finding.operatingPosture.context?.phase.value ?? "unknown"}; ${entry.finding.operatingPosture.reason}`);
+          console.log(`  Start: ${entry.disposition?.causalStart ?? "unknown"}`);
+          console.log(`  Steering: ${entry.disposition?.steering ?? "not yet recorded"}`);
+          console.log(`  Uncertainty: ${entry.disposition?.uncertainty ?? entry.finding.indeterminateReason ?? "diagnosis pending"}`);
+          if (entry.assessment) console.log(`  Attributed assessment: ${entry.assessment.actor ?? "unknown"} at ${entry.assessment.at}`);
+          const correction = entry.disposition?.correction;
+          if (correction) {
+            console.log(`  Applicability: ${correction.applicability}`);
+            console.log(`  Causal judgment: ${correction.causalJudgment}`);
+            console.log(`  Action (${correction.action.state}): ${correction.action.summary}`);
+          }
+          console.log(`  Later behavioral effect (owner report): ${correction?.effect.state ?? "unobserved"}${correction ? " — " + correction.effect.summary : " — a disposition or clearance alone is not changed behavior"}`);
+          for (const ref of entry.authority) console.log(`  ${ref.role ?? "Authority"} (${ref.state}): ${ref.path}${ref.selectedBy ? " selected by " + ref.selectedBy : ""}${ref.reason ? " — " + ref.reason : ""}`);
+          if (occurrenceRead) {
+            const view = diagnosisPreview(entry).readView;
+            console.log(`  Evidence preview; full record ${view.fullJsonBytes} JSON bytes: ${view.fullCommand}`);
+          } else console.log(`  ${entry.packet.instructions}`);
+        }
+      }
+    }
+  }
+  function fromFile(file: string): unknown {
+    const text = readFileSync(file, "utf8");
+    if (Buffer.byteLength(text) > 1048576) throw new Error("Health input exceeds 1 MiB");
+    return JSON.parse(text);
+  }
+  command.command("policy").description("Inspect effective policy and engine state; apply edited JSON with --file")
+    .option("--file <path>", "Apply policy JSON with an audit record").option("--json")
+    .action(async (o: { file?: string; json?: boolean }) => diagnosisRequest("/policy", o, o.file ? { value: fromFile(o.file) } : undefined));
+  command.command("checkpoint").description("Inspect or submit an outcome-boundary lineage census (not a per-edit ritual)")
+    .option("--file <path>", "Submit checkpoint JSON with exact queue and product evidence").option("--json")
+    .action(async (o: { file?: string; json?: boolean }) => diagnosisRequest("/checkpoints", o, o.file ? { value: fromFile(o.file) } : undefined));
+  command.command("diagnose").description("Preview policy admission; --apply creates or re-presents bounded diagnostic context")
+    .option("--apply").option("--json").action(async (o: { apply?: boolean; json?: boolean }) => diagnosisRequest("/evaluate", o, { apply: Boolean(o.apply) }));
+  const diagnosis = command.command("diagnosis").description("Read occurrences and record agent-owned dispositions");
+  diagnosis.command("list").description("List occurrence summaries; evidence payloads require --full")
+    .option("--json", "Summary array with explicit omitted fields and per-occurrence expansion commands")
+    .option("--full", "Complete records including all evidence and receipts; may be large")
+    .action(async (o: { json?: boolean; full?: boolean }) => diagnosisRequest("", o));
+  diagnosis.command("show <qitem-id>").description("Inspect current state and decisions; expand retained evidence deliberately")
+    .option("--json", "Summary JSON with omitted fields, original byte size and exact full command")
+    .option("--full", "Complete original record; use --full --json for lossless JSON (may be large)")
+    .action(async (id: string, o: { json?: boolean; full?: boolean }) => diagnosisRequest(`/${encodeURIComponent(id)}`, o));
+  diagnosis.command("record <qitem-id>").requiredOption("--file <path>", "Disposition JSON with verdict, causalStart, steering, uncertainty, evidenceRefs").option("--json")
+    .action(async (id: string, o: { file: string; json?: boolean }) => diagnosisRequest(`/${encodeURIComponent(id)}/disposition`, o, { value: fromFile(o.file) }));
+  diagnosis.command("notify <qitem-id>").description("Explicitly request human delivery under policy and verified connector readiness").option("--json")
+    .action(async (id: string, o: { json?: boolean }) => diagnosisRequest(`/${encodeURIComponent(id)}/notify`, o, {}));
+  return command;
+}

packages/cli/src/commands/host.ts

@@ -594,8 +594,9 @@ export function hostCommand(doctorDepsOverride?: DoctorDeps): Command {
     .argument("<url>", "The target daemon's address (http[s]://host:port, or host:port)")
     .option("--id <id>", "Registry id for the new host (default: derived from the hostname)")
     .option("--timeout <seconds>", "How long to wait for the target-side approval", "600")
+    .option("--human <address>", "Registered @external approval recipient on the target (required when several exist)")
     .option("--json", "JSON output")
-    .action(async (rawUrl: string, opts: { id?: string; timeout?: string; json?: boolean }) => {
+    .action(async (rawUrl: string, opts: { id?: string; timeout?: string; json?: boolean; human?: string }) => {
       // OPR.0.4.6.MH1 FR-6 — THE founder-simple add path: one pasted
       // address, one approval ON the target, done. The flag-heavy
       // `rig host add` stays as the unchanged advanced path. B1: the CLI
@@ -668,6 +669,7 @@ export function hostCommand(doctorDepsOverride?: DoctorDeps): Command {
       try {
         const res = await httpPost(`${targetBase}/api/hosts/pair-request`, {
           requester: `${userInfo().username}@${osHostname()}`,
+          ...(opts.human ? { human: opts.human } : {}),
         });
         issued = parseJson(res.body) as typeof issued;
         if (res.status !== 200 || !issued.pairId || !issued.code) {

packages/cli/src/commands/launch.ts

@@ -1,4 +1,6 @@
 import { Command } from "commander";
+import { readFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
 import { resolveEffectiveHost } from "../host-selection.js";
 import { DaemonClient } from "../client.js";
 import { getDaemonStatus, getDaemonUrl , daemonStatusGuard} from "../daemon-lifecycle.js";
@@ -12,6 +14,7 @@ type LaunchResponse = {
   logicalId?: string;
   sessionName?: string;
   error?: string;
+  message?: string;
   code?: string;
   launched?: Array<{ nodeId: string; logicalId: string; status: string; error?: string }>;
   held?: Array<{ nodeId: string; logicalId: string; reason: string }>;
@@ -58,15 +61,36 @@ export function launchCommand(depsOverride?: StatusDeps): Command {
     .option("--seats <ids>", "Comma-separated logical IDs for subset launch")
     .option("--hold-reason <reason>", "Reason for holding non-target seats")
     .option("--snapshot-id <id>", "Use this exact restore-usable snapshot")
+    .option("--retry-startup-from <member-file>", "Retry a stopped first start that failed during projection, using its original member fragment")
+    .option("--rig-root <path>", "Original absolute source root for --retry-startup-from")
     .option("--plan", "Show subset selection and non-target effects without mutation")
     .option("--json", "JSON output")
     .option("--host <id>", "Run on a remote host declared in ~/.openrig/hosts.yaml")
-    .action(async (rigId: string, nodeRef: string | undefined, opts: { json?: boolean; holdReason?: string; seats?: string; host?: string; snapshotId?: string; plan?: boolean }) => {
+    .action(async (rigId: string, nodeRef: string | undefined, opts: { json?: boolean; holdReason?: string; seats?: string; host?: string; snapshotId?: string; plan?: boolean; retryStartupFrom?: string; rigRoot?: string }) => {
       // OPR.0.4.6.MH1 FR-2: selected-host routing — explicit --host wins;
       // else the persisted selection feeds the SHIPPED --host path; no
       // selection = today exactly.
       opts.host = resolveEffectiveHost(opts.host);
       const deps = getDeps();
+      let retryBody: { retryStartupFrom: { member: Record<string, unknown>; rigRoot: string } } | undefined;
+      if (opts.retryStartupFrom || opts.rigRoot) {
+        if (!nodeRef || !opts.retryStartupFrom || !opts.rigRoot || !isAbsolute(opts.rigRoot) || opts.seats || opts.snapshotId || opts.plan || opts.holdReason) {
+          console.error("First-start retry requires one node, --retry-startup-from and an absolute --rig-root; it cannot combine with snapshot/subset/plan options.");
+          process.exitCode = 1;
+          return;
+        }
+        try {
+          const { parse } = await import("yaml");
+          const parsed = parse(readFileSync(opts.retryStartupFrom, "utf8"));
+          const member = parsed?.member ?? parsed;
+          if (!member || typeof member !== "object" || Array.isArray(member) || parsed.edges || member.edges) throw new Error("Supply a single member fragment without edges; retry preserves existing topology.");
+          retryBody = { retryStartupFrom: { member, rigRoot: opts.rigRoot } };
+        } catch (error) {
+          console.error(`Cannot read retry member: ${(error as Error).message}`);
+          process.exitCode = 1;
+          return;
+        }
+      }
 
       if (opts.host) {
         const { runRemoteHttpOp } = await import("../remote-host-ops.js");
@@ -88,7 +112,7 @@ export function launchCommand(depsOverride?: StatusDeps): Command {
             return;
           }
           apiPath = `/api/rigs/${encodeURIComponent(rigId)}/nodes/${encodeURIComponent(nodeRef)}/launch`;
-          body = opts.snapshotId ? { snapshotId: opts.snapshotId } : {};
+          body = retryBody ?? (opts.snapshotId ? { snapshotId: opts.snapshotId } : {});
         } else {
           console.error("Either a node reference or --seats is required for launch --host");
           process.exitCode = 1;
@@ -138,7 +162,7 @@ export function launchCommand(depsOverride?: StatusDeps): Command {
         }
         // Hard failure (no per-seat result to render — e.g. rig_not_found): error + exit.
         if (!res.data.launched && !res.data.held && !res.data.alreadyRunning) {
-          console.error(res.data.error ?? `Launch failed (HTTP ${res.status})`);
+          console.error(res.data.error ?? res.data.message ?? `Launch failed (HTTP ${res.status})`);
           process.exitCode = 1;
           return;
         }
@@ -187,7 +211,7 @@ export function launchCommand(depsOverride?: StatusDeps): Command {
         return;
       }
 
-      const body: Record<string, string> = {};
+      const body: Record<string, unknown> = retryBody ?? {};
       if (opts.snapshotId) body.snapshotId = opts.snapshotId;
 
       const res = await client.post<LaunchResponse>(`/api/rigs/${encodeURIComponent(rigId)}/nodes/${encodeURIComponent(nodeRef)}/launch`, body);
@@ -198,7 +222,7 @@ export function launchCommand(depsOverride?: StatusDeps): Command {
       }
 
       if (res.status >= 400 || !res.data.ok) {
-        console.error(res.data.error ?? `Launch failed (HTTP ${res.status})`);
+        console.error(res.data.error ?? res.data.message ?? `Launch failed (HTTP ${res.status})`);
         process.exitCode = 1;
         return;
       }

packages/cli/src/commands/policy.ts

@@ -120,6 +120,18 @@ export function policyCommand(): Command {
     `Teach and record the rig-level permission policy. ${HONESTY_PIN} (The context-mode verb formerly at this name is now: rig mode.)`,
   );
 
+  const permissions = new Command("permissions").description(
+    "Native permission policy: list, show, current and apply. Work posture is separate; this does not relaunch seats.",
+  );
+  registerPermissionCommands(permissions);
+  cmd.addCommand(permissions);
+  // Compatibility aliases share the exact actions and output, including JSON and exit codes.
+  registerPermissionCommands(cmd);
+  return cmd;
+}
+
+function registerPermissionCommands(cmd: Command): void {
+
   cmd
     .command("list")
     .description(`List the built-in permission-policy templates, plus the custom policies visible in a spec context. ${HONESTY_PIN}`)
@@ -313,7 +325,6 @@ export function policyCommand(): Command {
       if (step.status === "fail") process.exitCode = 1;
     });
 
-  return cmd;
 }
 
 // Re-exported so the parity test can assert the twin surface without deep-importing.

packages/cli/src/commands/preflight.ts

@@ -43,6 +43,7 @@ export function preflightCommand(depsOverride?: PreflightCommandDeps): Command {
       for (const check of result.checks) {
         if (check.ok) {
           console.log(`✓ ${check.name}`);
+          if (check.warning) console.log(`  Note: ${check.warning}`);
         } else {
           console.log(`✗ ${check.name}: ${check.error}`);
           if (check.reason) console.log(`  Why: ${check.reason}`);