@aperant/framework 0.17.0 → 0.19.0

package/src/cli/coordination/auto-emit-artifact-ready.mjs

@@ -3,8 +3,8 @@
  * auto-emit-artifact-ready.mjs — code-enforced plan-ready signal.
  *
  * Promotes the `artifact.ready{kind:'plan'}` emit from a markdown contract
- * in `skills/apt-plan/adapters/conductor.md` to a framework-level
- * postcondition of `apt-tools commit`. This closes the Conductor v2 gap
+ * in `skills/apt-plan/adapters/showrunner.md` to a framework-level
+ * postcondition of `apt-tools commit`. This closes the Showrunner v2 gap
  * exposed during live verification 2026-05-15: the planner's QUICK /
  * SIMPLE track is hard-exempt from "new interaction discipline"
  * (Aperant Fast Path Guarantee ID-05), so the markdown emit step was
@@ -19,7 +19,7 @@
  *     OpenCode, Codex) traverses via `apt-tools commit`
  *
  * Conditions for emit (ALL must hold — otherwise no-op):
- *   1. `APERANT_TERMINAL_ID` is set in process.env (Conductor PTY context).
+ *   1. `APERANT_TERMINAL_ID` is set in process.env (Showrunner PTY context).
  *   2. The committed files include a path matching
  *      `.aperant/tasks/{task-id}/implementation_plan.json`.
  *
@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto'
 import { appendFileSync, mkdirSync, readFileSync } from 'node:fs'
 import { hostname } from 'node:os'
 import { join } from 'node:path'
-import { validateConductorEvent } from './event-schema.mjs'
+import { validateShowrunnerEvent } from './event-schema.mjs'
 
 const PLAN_PATH_RE = /^(?:\.\/)?\.aperant\/tasks\/([^/]+)\/implementation_plan\.json$/
 
@@ -70,7 +70,7 @@ export function maybeAutoEmitPlanReady({ files, projectRoot }) {
 		terminal_id: terminalId,
 	}
 
-	const validation = validateConductorEvent('artifact.ready', data)
+	const validation = validateShowrunnerEvent('artifact.ready', data)
 	if (!validation.ok) {
 		return { emitted: false, reason: `schema violation: ${validation.error}` }
 	}

package/src/cli/coordination/event-schema.d.ts

@@ -5,9 +5,11 @@
 
 export type ValidateResult = { ok: true } | { ok: false; error: string }
 
-export function validateConductorEvent(
+export function validateShowrunnerEvent(
 	op: string,
 	data: Record<string, unknown> | undefined | null,
 ): ValidateResult
 
-export const CONDUCTOR_VALIDATED_OPS: ReadonlySet<string>
+export const SHOWRUNNER_VALIDATED_OPS: ReadonlySet<string>
+
+export const PRODUCE_VALIDATED_OPS: ReadonlySet<string>

package/src/cli/coordination/event-schema.mjs

@@ -1,12 +1,12 @@
 /**
  * @internal
- * event-schema.mjs — single source of truth for conductor event payload shapes.
+ * event-schema.mjs — single source of truth for showrunner event payload shapes.
  *
  * Why this lives in `framework`, not `core`:
  *   `packages/core` depends on `@aperant/framework`. The schema is shared by
  *   the CLI write path (`commands/event.mjs`), the framework lifecycle write
  *   seam (`coordination/store.mjs:appendEvent`), and the core IPC write seam
- *   (`packages/core/src/runtime/orchestration/conductor/event-log.ts`).
+ *   (`packages/core/src/runtime/orchestration/showrunner/event-log.ts`).
  *   Putting it in the lower layer keeps a single rule table that every
  *   writer can import.
  *
@@ -22,11 +22,11 @@
  *   - `awaiting-input` / `input-rescinded` MUST carry both terminal_id and
  *     request_id so the drawer can pair cards strictly.
  *   - `artifact.ready{kind:'plan'}` is the canonical plan-completion signal
- *     consumed by the conductor's reviewer queue (Step 5's reviewPlan tool).
+ *     consumed by the showrunner's reviewer queue (Step 5's reviewPlan tool).
  */
 
-/** Conductor ops the schema enforces. Other ops pass through unchanged. */
-const CONDUCTOR_OPS = new Set([
+/** Showrunner ops the schema enforces. Other ops pass through unchanged. */
+const SHOWRUNNER_OPS = new Set([
 	'phase.changed',
 	'artifact.ready',
 	'awaiting-input',
@@ -35,34 +35,120 @@ const CONDUCTOR_OPS = new Set([
 	'budget.exceeded',
 	'terminal.enrolled',
 	'terminal.unenrolled',
-	'conductor.intent',
-	'conductor.cross_check',
-	'conductor.realignment',
+	'showrunner.intent',
+	'showrunner.cross_check',
+	'showrunner.realignment',
 	// c-4 (action-capable) — gate verdict + boot-replay audit trail
-	'conductor.action.executed',
-	'conductor.action.gate_blocked',
-	'conductor.boot_reconciled',
+	'showrunner.action.executed',
+	'showrunner.action.gate_blocked',
+	'showrunner.boot_reconciled',
 	// AC21 — MCP-server consent decisions audited to .aperant/events/*.jsonl
 	'mcp-consent.approved',
 	'mcp-consent.denied',
 	'mcp-consent.tofu-reprompt',
 ])
 
+/**
+ * Produce outer-loop ops (M1) — the `/apt:produce` roadmap-mutation vocabulary.
+ * Kept as a PARALLEL set (not merged into SHOWRUNNER_OPS) so the two surfaces
+ * stay conceptually distinct; both are consulted by the same
+ * `validateShowrunnerEvent` entry point that `store.appendEvent` calls, so a
+ * malformed produce event is rejected fail-closed on the canonical event log
+ * (ID-04 / AC4). Every produce op carries a `run_id` tagging its run.
+ */
+const PRODUCE_OPS = new Set([
+	'produce.run.started',
+	'produce.setpoint.frozen',
+	'produce.roadmap.milestone_added',
+	'produce.roadmap.milestone_status_changed',
+	'produce.tick',
+	// M2 — the oracle + held-out cross-family blind-probe forensic trail. Every
+	// oracle/probe decision lands on the same append-only log, fail-closed
+	// against malformed entries (US-1 / AC1 / AC12). The probe ops are
+	// STRUCTURALLY blind: they carry only a hash/result/family, NEVER the probe
+	// content (ID-M2-03). The projection still folds `produce.roadmap.*` ONLY,
+	// so these never enter the roadmap the Showrunner re-reads each tick.
+	'produce.milestone.implemented',
+	'produce.probe.frozen',
+	'produce.probe.run',
+	'produce.oracle.judged',
+	'produce.oracle.verdict',
+	'produce.oracle.probe_gap',
+	// M3 — the Lyapunov acceptance-criteria ledger + scope-change forensic trail.
+	// Every criteria-open / criteria-close / scope-change decision lands on the
+	// same append-only log, fail-closed against malformed entries (US-4 / AC1). V
+	// (open acceptance criteria) = declared − closed, folded by ledger.mjs. The
+	// projection still folds `produce.roadmap.*` ONLY — criteria/scope ops are a
+	// SEPARATE fold, so the M1/M2 roadmap-blindness invariant is preserved.
+	'produce.criteria.declared',
+	'produce.criteria.closed',
+	'produce.scope.changed',
+	// M4 — the saga + verification-TTL forensic trail. Each plan→execute→verify→
+	// review→ship phase transition, every FORWARD compensation, every diverse
+	// review verdict, and every TTL re-verify / regression lands on the same
+	// append-only log, fail-closed against malformed entries (US-2 / AC1). The
+	// saga fold is SEPARATE from the roadmap projection (which still folds
+	// `produce.roadmap.*` ONLY), so the M1/M2/M3 blindness invariant holds. The
+	// saga-phase ops enforce a closed `phase` vocabulary (ALLOWED_SAGA_PHASES),
+	// mirroring the phase.changed.to / artifact.ready.kind allowed-value pattern.
+	'produce.saga.phase_entered',
+	'produce.saga.phase_completed',
+	'produce.saga.compensated',
+	'produce.saga.reviewed',
+	'produce.ttl.reverified',
+	'produce.ttl.regression_detected',
+	// M5 — the WSJF/WIP scheduler's audited decision. The wake `tick` emits ONE
+	// `produce.schedule.computed` alongside its `produce.tick` so the scheduler's
+	// pick is a recorded fact on the append-only log (the event-sourced ethos). It
+	// uses the `produce.schedule.*` prefix — the roadmap projection folds
+	// `produce.roadmap.*` ONLY, so this op NEVER enters the roadmap the Showrunner
+	// re-reads (the M1/M2 blindness invariant holds automatically — ID-M5-06).
+	'produce.schedule.computed',
+	// M6 — the Claim Envelope lifecycle forensic trail. A claim's CONTENT lives in
+	// the frozen `claims/<claim-id>.json` file, referenced by `content_hash` — it
+	// NEVER touches the log (ID-M6-07, mirrors produce.probe.frozen /
+	// produce.setpoint.frozen). `declared` seeds the claim ledger, `expired` drops
+	// it from the active set, `consumed` records a bounded down-projected delta
+	// (target_kind value-checked against the closed set). The claim ledger is a
+	// SEPARATE fold (projectClaims) — the roadmap projection still folds
+	// `produce.roadmap.*` ONLY, so these ops NEVER enter the roadmap the Showrunner
+	// re-reads (the M1/M2 blindness invariant holds automatically).
+	'produce.claim.declared',
+	'produce.claim.expired',
+	'produce.claim.consumed',
+])
+
 /** Allowed values for `phase.changed.to` — PTY busy/idle only. */
 const ALLOWED_PHASE_VALUES = new Set(['busy', 'idle'])
 
+/**
+ * Allowed values for the saga `phase` on `produce.saga.phase_entered` /
+ * `produce.saga.phase_completed` / `produce.saga.compensated` (M4). The saga
+ * models plan→execute→verify→review→ship; an out-of-vocabulary phase is rejected
+ * fail-closed, mirroring the ALLOWED_PHASE_VALUES value check for phase.changed.
+ */
+const ALLOWED_SAGA_PHASES = new Set(['plan', 'execute', 'verify', 'review', 'ship'])
+
+/**
+ * Allowed values for the claim `target_kind` on `produce.claim.consumed` (M6).
+ * Consumption is a DELTA down-projection onto ONE acceptance-criterion / subtask /
+ * proof-obligation (ID-M6-06); an out-of-vocabulary kind is rejected fail-closed,
+ * mirroring the ALLOWED_SAGA_PHASES value check for the saga-phase ops.
+ */
+const ALLOWED_CLAIM_TARGET_KINDS = new Set(['acceptance_criterion', 'subtask', 'proof_obligation'])
+
 /** Allowed values for `artifact.ready.kind`. */
 const ALLOWED_ARTIFACT_KINDS = new Set(['plan', 'spec', 'build', 'review'])
 
 /**
- * Validate the data payload of a conductor event against the op's contract.
+ * Validate the data payload of a showrunner event against the op's contract.
  *
  * @param {string} op
  * @param {Record<string, unknown> | undefined | null} data
  * @returns {{ ok: true } | { ok: false, error: string }}
  */
-export function validateConductorEvent(op, data) {
-	if (!CONDUCTOR_OPS.has(op)) return { ok: true }
+export function validateShowrunnerEvent(op, data) {
+	if (!SHOWRUNNER_OPS.has(op) && !PRODUCE_OPS.has(op)) return { ok: true }
 	const d = data && typeof data === 'object' ? data : {}
 
 	switch (op) {
@@ -105,13 +191,13 @@ export function validateConductorEvent(op, data) {
 			return { ok: true }
 		}
 
-		case 'conductor.intent':
+		case 'showrunner.intent':
 			return requireFields(op, d, ['terminal_id', 'request_id', 'action', 'reasoning'])
 
-		case 'conductor.cross_check':
+		case 'showrunner.cross_check':
 			return requireFields(op, d, ['terminal_id', 'request_id'])
 
-		case 'conductor.realignment': {
+		case 'showrunner.realignment': {
 			const r = requireFields(op, d, ['terminal_id', 'request_id_orig'])
 			if (!r.ok) return r
 			if (d.attempt_n === undefined || d.attempt_n === null)
@@ -125,10 +211,10 @@ export function validateConductorEvent(op, data) {
 		case 'budget.exceeded':
 			return requireFields(op, d, ['terminal_id'])
 
-		case 'conductor.action.executed':
+		case 'showrunner.action.executed':
 			return requireFields(op, d, ['terminal_id', 'request_id', 'action_kind', 'idempotency_key'])
 
-		case 'conductor.action.gate_blocked':
+		case 'showrunner.action.gate_blocked':
 			return requireFields(op, d, [
 				'terminal_id',
 				'request_id',
@@ -152,7 +238,130 @@ export function validateConductorEvent(op, data) {
 				'session_id',
 			])
 
-		case 'conductor.boot_reconciled': {
+		// Produce outer-loop (M1) — roadmap-mutation + tick vocabulary. Every
+		// op requires its `run_id`; roadmap ops additionally carry the
+		// milestone identity / status the projection folds (ID-04 / AC4).
+		case 'produce.run.started':
+			return requireFields(op, d, ['run_id', 'setpoint_hash'])
+
+		case 'produce.setpoint.frozen':
+			return requireFields(op, d, ['run_id', 'setpoint_hash', 'setpoint_path'])
+
+		case 'produce.roadmap.milestone_added':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'title'])
+
+		case 'produce.roadmap.milestone_status_changed':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'status'])
+
+		case 'produce.tick':
+			return requireFields(op, d, ['run_id'])
+
+		// Produce M2 — oracle + held-out cross-family blind-probe vocabulary.
+		// The implementer family is the recorded disjointness anchor (ID-M2-02);
+		// the probe ops are content-blind (only hash/result/family — ID-M2-03).
+
+		// The Showrunner records who implemented a milestone once per milestone;
+		// the cross-family rule is enforced against THIS recorded fact.
+		case 'produce.milestone.implemented':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'implementer_family'])
+
+		// The frozen blind-probe SET is announced by hash + author family ONLY —
+		// NEVER the probe content (structural probe-blindness, AC5).
+		case 'produce.probe.frozen':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'probe_set_hash', 'author_family'])
+
+		// A blind-probe RUN carries only its pass/fail result, the running family,
+		// and the HEAD sha it ran against — no probe content.
+		case 'produce.probe.run':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'result', 'probe_family', 'head_sha'])
+
+		// The independent evidence-quality oracle's verdict over verify-proof's
+		// captured evidence, tagged with the (cross-family) oracle family.
+		case 'produce.oracle.judged':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'verdict', 'oracle_family'])
+
+		// The two-gate done verdict (visible AND blind agree) — the ONLY path to
+		// `done` (ID-03: the Showrunner never self-attests).
+		case 'produce.oracle.verdict':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'verdict'])
+
+		// The reward-hacking canary near-miss: visible gate passed, blind gate
+		// failed → the milestone stays open (ID-M2-06 / AC9).
+		case 'produce.oracle.probe_gap':
+			return requireFields(op, d, ['run_id', 'milestone_id'])
+
+		// Produce M3 — the Lyapunov acceptance-criteria ledger (V = declared −
+		// closed) + the scope-change escape hatch (ID-M3-01 / ID-M3-04 / AC1). A
+		// criterion binds to a milestone; it opens on `declared` (V += 1), closes
+		// on `closed` (V −= 1). `produce.scope.changed` is the ONLY sanctioned
+		// post-descent V increase — `milestone_id` is optional (a scope change may
+		// not target one milestone), so only `run_id` + `reason` are required.
+		case 'produce.criteria.declared':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'criterion_id', 'text'])
+
+		case 'produce.criteria.closed':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'criterion_id'])
+
+		case 'produce.scope.changed':
+			return requireFields(op, d, ['run_id', 'reason'])
+
+		// Produce M4 — the saga phase model + FORWARD compensators + verification-TTL.
+		// The saga-phase ops (entered/completed/compensated) enforce the closed
+		// `phase` vocabulary (ALLOWED_SAGA_PHASES), mirroring the phase.changed.to
+		// value check. No op names a probe/review CONTENT field — the roadmap
+		// projection still folds `produce.roadmap.*` ONLY (blindness preserved).
+		case 'produce.saga.phase_entered':
+		case 'produce.saga.phase_completed': {
+			const r = requireFields(op, d, ['run_id', 'milestone_id', 'phase'])
+			if (!r.ok) return r
+			return checkSagaPhase(op, d)
+		}
+
+		case 'produce.saga.compensated': {
+			const r = requireFields(op, d, ['run_id', 'milestone_id', 'phase', 'compensator'])
+			if (!r.ok) return r
+			return checkSagaPhase(op, d)
+		}
+
+		// A diverse-review verdict over the milestone's diff, tagged with the
+		// (cross-family) reviewer family. Content-free — verdict + family only.
+		case 'produce.saga.reviewed':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'reviewer_family', 'verdict'])
+
+		// A scheduled post-`done` TTL re-verify RUN against HEAD — result/head_sha
+		// only, never probe content. A regression fires the forward compensator.
+		case 'produce.ttl.reverified':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'head_sha', 'result'])
+
+		case 'produce.ttl.regression_detected':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'head_sha'])
+
+		// Produce M5 — the WSJF/WIP scheduler's recorded pick. Only `run_id` is
+		// required (the `picked` ids + `wip_limit` are optional context); the
+		// roadmap projection folds `produce.roadmap.*` ONLY, so it never sees this
+		// op (blindness preserved — ID-M5-06).
+		case 'produce.schedule.computed':
+			return requireFields(op, d, ['run_id'])
+
+		// Produce M6 — the Claim Envelope lifecycle. `declared` carries a
+		// `content_hash` ONLY (the full envelope lives in the frozen
+		// claims/<claim-id>.json file — ID-M6-07); `consumed.target_kind` is
+		// value-checked against the closed set (mirrors ALLOWED_SAGA_PHASES /
+		// checkSagaPhase). No op names a claim-content field — the roadmap
+		// projection still folds `produce.roadmap.*` ONLY (blindness preserved).
+		case 'produce.claim.declared':
+			return requireFields(op, d, ['run_id', 'profile', 'claim_id', 'content_hash'])
+
+		case 'produce.claim.expired':
+			return requireFields(op, d, ['run_id', 'claim_id', 'reason'])
+
+		case 'produce.claim.consumed': {
+			const r = requireFields(op, d, ['run_id', 'claim_id', 'target_kind'])
+			if (!r.ok) return r
+			return checkClaimTargetKind(op, d)
+		}
+
+		case 'showrunner.boot_reconciled': {
 			// Fleet-wide event — numeric fields only. All optional but if
 			// present must be finite numbers (zero allowed).
 			const numFields = ['cleaned_leases', 'replayed', 'start_offset']
@@ -174,7 +383,10 @@ export function validateConductorEvent(op, data) {
 }
 
 /** Set of ops the schema validates — exported for test enumeration. */
-export const CONDUCTOR_VALIDATED_OPS = CONDUCTOR_OPS
+export const SHOWRUNNER_VALIDATED_OPS = SHOWRUNNER_OPS
+
+/** Produce outer-loop ops the schema validates — exported for test enumeration. */
+export const PRODUCE_VALIDATED_OPS = PRODUCE_OPS
 
 /**
  * @param {string} op
@@ -191,3 +403,46 @@ function requireFields(op, d, fields) {
 	if (missing.length === 0) return { ok: true }
 	return { ok: false, error: `${op} missing required field(s): ${missing.join(', ')}` }
 }
+
+/**
+ * Validate the saga `phase` value against ALLOWED_SAGA_PHASES (M4). Mirrors the
+ * inline phase.changed.to value check — fail-closed on an out-of-vocabulary
+ * phase so a saga event can never carry an unknown phase onto the log.
+ *
+ * @param {string} op
+ * @param {Record<string, unknown>} d
+ * @returns {{ ok: true } | { ok: false, error: string }}
+ */
+function checkSagaPhase(op, d) {
+	if (!ALLOWED_SAGA_PHASES.has(String(d.phase))) {
+		return {
+			ok: false,
+			error: `${op}.phase must be one of [${[...ALLOWED_SAGA_PHASES].join(', ')}], got: ${String(
+				d.phase,
+			)}`,
+		}
+	}
+	return { ok: true }
+}
+
+/**
+ * Validate the claim `target_kind` value against ALLOWED_CLAIM_TARGET_KINDS (M6).
+ * Mirrors checkSagaPhase — fail-closed on an out-of-vocabulary target kind so a
+ * produce.claim.consumed event can never carry an unknown delta target onto the
+ * log (ID-M6-06).
+ *
+ * @param {string} op
+ * @param {Record<string, unknown>} d
+ * @returns {{ ok: true } | { ok: false, error: string }}
+ */
+function checkClaimTargetKind(op, d) {
+	if (!ALLOWED_CLAIM_TARGET_KINDS.has(String(d.target_kind))) {
+		return {
+			ok: false,
+			error: `${op}.target_kind must be one of [${[...ALLOWED_CLAIM_TARGET_KINDS].join(
+				', ',
+			)}], got: ${String(d.target_kind)}`,
+		}
+	}
+	return { ok: true }
+}

package/src/cli/coordination/store.mjs

@@ -32,7 +32,7 @@ import { withFileLock } from '../util/fs-lock.mjs'
 import { atomicWriteJson } from '../util/io.mjs'
 import { getAgentIdentity, resolveSharedRoot } from './agent-identity.mjs'
 import { appendLifecycleEvent } from './event-log.mjs'
-import { validateConductorEvent } from './event-schema.mjs'
+import { validateShowrunnerEvent } from './event-schema.mjs'
 import { advanceLastSeen as lastSeenAdvance, readLastSeen as lastSeenRead } from './last-seen.mjs'
 import {
 	listActive as teamStatusListActive,
@@ -131,16 +131,16 @@ export function createCoordinationStore(projectRoot) {
 		 * call via appendLifecycleEvent. Best-effort: filesystem errors are
 		 * swallowed so a missing events/ dir never breaks task lifecycle.
 		 *
-		 * Step 1 — schema gate: conductor ops written via the store seam are
+		 * Step 1 — schema gate: showrunner ops written via the store seam are
 		 * validated against `event-schema.mjs` before they reach disk.
 		 * Schema violations throw (caught here and surfaced via console.warn)
-		 * because a malformed conductor event would silently break the
+		 * because a malformed showrunner event would silently break the
 		 * drawer's pairing logic — we want it loud, not best-effort.
 		 */
 		appendEvent(evt) {
 			try {
 				if (evt && typeof evt.op === 'string') {
-					const validation = validateConductorEvent(evt.op, evt.data)
+					const validation = validateShowrunnerEvent(evt.op, evt.data)
 					if (!validation.ok) {
 						console.warn(`[store.appendEvent] schema violation: ${validation.error}`)
 						return null

package/src/cli/dispatch.mjs

@@ -78,6 +78,7 @@ import { cmdPersonas } from './commands/personas.mjs'
 import { cmdPlanApproval } from './commands/plan-approval.mjs'
 import { cmdPrReview } from './commands/pr-review.mjs'
 import { cmdPrecompactHook } from './commands/precompact-hook.mjs'
+import { cmdProduce } from './commands/produce.mjs'
 import { cmdProductContext } from './commands/product-context.mjs'
 import { cmdProfile } from './commands/profile.mjs'
 // cmdRecipeDiff — loaded lazily in the dispatch handler (Fast Path PRF-001)
@@ -326,6 +327,7 @@ export const DISPATCH = {
 	team: (args) => wrap(cmdTeam)(args[1], args[2], args.slice(3)),
 	active: (args) => wrap(cmdActive)(args[1], args[2], args.slice(3)),
 	roadmap: (args) => wrap(cmdRoadmap)(args[1], args[2], args.slice(3)),
+	produce: (args) => wrap(cmdProduce)(args[1], args[2], args.slice(3)),
 	seed: (args) => wrap(cmdSeed)(args[1], args[2], args.slice(3)),
 	workflow: (args) => wrap(cmdWorkflow)(args[1], args[2], args.slice(3)),
 	'pr-review': (args) => wrap(cmdPrReview)(args[1], args[2], args.slice(3)),

package/src/cli/help.mjs

@@ -29,6 +29,7 @@ Commands:
   risk-check <dir> --paths <p1> [--operation <type>]  Classify file paths by risk level
 
   task create <dir> --description <text> [--scope <s>] [--milestone <id>] [--phase <id>] [--roadmap-ref-url <url>] [--depends-on <refs>] [--track <T>] [--autonomy <N>]  Create isolated task
+  task ensure <dir> --description <text> --intent <create-new|require-existing|self-managed|none> [--track <T>] [--autonomy <N>] [--scope <s>] [--id <id>]  Deterministic idempotent allocator: create-new provisions a per-task worktree (idempotent on re-run), require-existing resolves the active task without minting, none/self-managed allocate nothing
   task list <dir> [--scope <s>] [--blocked-by <id>]  List active tasks (optionally filtered)
   task get <dir> --id <task-id>         Get task details and artifacts
   task update <dir> --id <id> [--lifecycle-phase <p>] [--pr-url <url>] [--subtasks-total <N>] [--depends-on <refs>]  Update non-linkage task state; --pr-url may arm ci-watch per ci_watch.after_ship
@@ -136,6 +137,35 @@ Commands:
   ci-watch start|stop|status|tick <dir> [--pr <N>] [...]   /apt:watch-ci primitives — see SKILL.md for full flag matrix
   ci-watch sweep <dir> --orphaned [--dry-run]              BUG-027: enumerate ci-watches state files, query gh per PR, remove terminal-state (MERGED|CLOSED) entries (manual GC; rate-limited)
 
+  produce start <dir> --outcome "<o>" [--run-id <id>]      /apt:produce M1 — freeze an immutable acceptance setpoint under .aperant/produce/<run-id>/ (idempotent-reuse on --run-id, never overwrites); emits produce.run.started + produce.setpoint.frozen
+  produce add-milestone <dir> --run-id <id> --title "<t>" [--id <mid>]   Append produce.roadmap.milestone_added + refresh the derived roadmap.json projection cache
+  produce set-milestone-status <dir> --run-id <id> --milestone <mid> --status <planned|in_progress|done> [--verdict-path <p>]   Append produce.roadmap.milestone_status_changed; --status done is the M2 two-gate adjudication (visible oracle AND blind probe)
+  produce status <dir> --run-id <id>                       Re-project the roadmap from the append-only event log (no in-memory authority)
+  produce tick <dir> --run-id <id>                         Run exactly ONE wake tick — re-project from disk, emit produce.tick, compute next_action + next_tick_hint, then exit (no loop)
+  produce record-implementer <dir> --run-id <id> --milestone <mid> --implementer-family <fam>   /apt:produce M2 — record the implementer family (the cross-family disjointness anchor)
+  produce resolve-probe-family <dir> --run-id <id> [--milestone <mid>] [--implementer-family <fam>] [--host-family <fam>] [--available-families a,b,c]   M2 — resolve a probe/oracle family DISJOINT from the implementer + a LIVE model (never hardcoded); available:false when none
+  produce oracle prepare <dir> --run-id <id> --milestone <mid> --verdict-path <p>   M2 — extract verify-proof's v2 verdict (must be approved) + tests[] evidence into a cross-family judge payload
+  produce oracle record <dir> --run-id <id> --milestone <mid> --verdict <pass|fail> --oracle-family <fam>   M2 — record produce.oracle.judged (refused when oracle_family === implementer)
+  produce probe freeze <dir> --run-id <id> --milestone <mid> --probe-file <p> --author-family <fam>   M2 — freeze an immutable held-out probe set (hash + family only; refused when author_family === implementer)
+  produce probe record <dir> --run-id <id> --milestone <mid> --result <pass|fail> --probe-family <fam> --head-sha <sha>   M2 — record produce.probe.run (result/family/sha only; refused when probe_family === implementer)
+  produce probe sweep <dir> --run-id <id> [--sample N]     M2 — deterministic rotating sample of already-done milestones to blind-re-probe against HEAD
+  produce canary <dir> --run-id <id>                       M2 — green-on-visible MINUS green-on-blind + per-milestone breakdown (the reward-hacking canary)
+  produce declare-criteria <dir> --run-id <id> --milestone <mid> --criterion "<text>" [--criterion-id <cid>] [--scope-change "<reason>"]   /apt:produce M3 — open one acceptance criterion (V += 1); rejected after descent unless --scope-change justifies the increase (anti-windup)
+  produce progress <dir> --run-id <id>                     M3 — re-read the Lyapunov V-series from the log: open-criteria count strictly decreasing across shipped milestones + any un-sanctioned-increase violations (flags, never rejects)
+  produce saga enter <dir> --run-id <id> --milestone <mid> --phase <plan|execute|verify|review|ship>   /apt:produce M4 — append produce.saga.phase_entered (separate fold from the roadmap projection)
+  produce saga complete <dir> --run-id <id> --milestone <mid> --phase <plan|execute|verify|review|ship>   M4 — append produce.saga.phase_completed
+  produce saga compensate <dir> --run-id <id> --milestone <mid> --phase <p> [--reason "<r>"]   M4 — fire the FORWARD compensator (verify|review|ship ships a revert + reopens + re-plans; NEVER rolls back a merged PR); records the descriptor, does not execute it
+  produce saga resolve-reviewer <dir> --run-id <id> --milestone <mid> [--host-family <fam>] [--available-families a,b,c]   M4 — resolve a REVIEW-phase reviewer family DISJOINT from the implementer + a LIVE model (reuses resolveProbeFamily; never hardcoded); available:false when none
+  produce saga review <dir> --run-id <id> --milestone <mid> --verdict <pass|fail> --reviewer-family <fam>   M4 — record produce.saga.reviewed (refused when reviewer_family === implementer)
+  produce saga status <dir> --run-id <id>                  M4 — re-project per-milestone saga phase state + pending compensation from the log (no roadmap status mutation)
+  produce ttl select <dir> --run-id <id> --head-sha <sha> [--sample N]   M4 — deterministic rotating sample of OLD done milestones STALE against HEAD (reuses the M2 rotation; a milestone re-verified against current HEAD is excluded as fresh)
+  produce ttl reverify <dir> --run-id <id> --milestone <mid> --result <pass|fail> --probe-family <fam> --head-sha <sha>   M4 — cross-family re-verify; --result fail appends ttl.reverified + ttl.regression_detected + fires the FORWARD compensator (ships a revert, not a rollback)
+  produce schedule <dir> --run-id <id> [--wip N]           /apt:produce M5 — WSJF-rank the ready milestones (cost-of-delay / job-size) + a WIP-limited pick; dependency-aware readiness (blocked / cycle), M4-regression re-entry; read-only
+  produce claim declare <dir> --run-id <id> --profile <p> --claim-file <path> [--claim-id <id>]   /apt:produce M6 — validate + freeze an immutable Claim Envelope to claims/<claim-id>.json (interop, not a 4th store); rejects a global/unbounded scope, empty preconditions, or missing expiry fail-closed; logs produce.claim.declared (content_hash only)
+  produce claim list <dir> --run-id <id>                   M6 — re-project the claim ledger (declared − expired) folded from the append-only log; produce.claim.* never enters the roadmap projection
+  produce claim expire <dir> --run-id <id> --claim-id <id> [--reason "<r>"]   M6 — append produce.claim.expired; the claim drops out of the ledger's active set (anti-corrosion manual expiry)
+  produce claim consume <dir> --run-id <id> [--milestone <mid>]   M6 — emit the STRUCTURED delta {claim_id, targets:[{kind, requirement, ref?}]} derived from resolution_verifier (never a lesson-text paste); skips expired / HEAD-invalidated / precondition-unmatched claims
+
   followups check <dir> --task-id <id>                      G45: derive the expected follow-up universe (Out of Scope ∪ raw review rows ∪ qa findings) + report missing/unadjudicated/unfixed/undispositioned rows; exit 1 when the ledger is dishonest
   followups disposition <dir> --task-id <id> --row <row-id> --kind <filed_task|executed_commit|parked_note|dropped_by_user> --ref <ref> [--reason <text>]   G45: flip a ledger row to dispositioned (atomic; dropped_by_user requires --reason)
   followups policy <dir> --task-id <id>                     G45: effective disposition policy (ask|file|chain + max_chain_depth) from config.followups when set, else autonomy-derived

package/src/cli/install/legacy-paths.mjs

@@ -108,6 +108,7 @@ export const LEGACY_INSTALL_PATHS = Object.freeze({
 			'agents/apt-personas.md',
 			'agents/apt-plan.md',
 			'agents/apt-pr-review.md',
+			'agents/apt-produce.md',
 			'agents/apt-prototype.md',
 			'agents/apt-quick.md',
 			'agents/apt-release-notes.md',
@@ -153,6 +154,7 @@ export const LEGACY_INSTALL_PATHS = Object.freeze({
 			'commands/apt-personas.md',
 			'commands/apt-plan.md',
 			'commands/apt-pr-review.md',
+			'commands/apt-produce.md',
 			'commands/apt-prototype.md',
 			'commands/apt-quick.md',
 			'commands/apt-release-notes.md',