@awebai/oats 0.24.5 → 0.24.6

package/bin/oats.mjs

@@ -26,7 +26,7 @@ import {
   capabilityManifests, capabilityManifest, capabilityMissingRequires, capabilityIntegrity, capabilityTrust, capabilityExecutablePath, activateCapturedScaffold, loadCapturedDispatch, inspectPortableOnboarding, prepareCapturedComposition, resolveCapturedHelper, capturedNativeSessionAvailability, scaffoldCapturedInstance, startCapturedInstanceSession, withCapturedBindingFile, withCapturedInvocationContextFile,
   readCapabilityLocks, writeCapabilityLock, admitCapturedAction, beginCapturedIntent, settleCapturedIntent,
   parsePackageSource, inspectGitSourceRoot, acquirePackage, restorePackages, listInstalledPackages, readPackageLocks, readLockedConfigTemplates,
-  officialCapabilityPackage, officialPackageCatalog, DEFAULT_PACKAGE_PATH,
+  officialCapabilityPackage, officialPackageCatalog, describeOfficialCatalog, DEFAULT_PACKAGE_PATH,
   approveCapability, approveAvailableCapability, updatePackage, removePackage, migrateLegacyLock, applyLegacyLockMigration,
   packageIntegrity, capabilityArtifactIntegrity, verifyCapabilityInstallation, installedCapabilityDir, installedCapabilitiesDir, ownedCapabilitiesDir, loadPackageManifestAt,
   resolveOatsConfig, resolveWorkMode, composeInstanceAgentsMd, planInstanceResources, parseYamlNested, assertSafeConfigValue, assertSafeConfigWriteKey, stripInternalAnnotations, withConfigFile, packagedInject, teamAgentRoots,
@@ -63,7 +63,7 @@ import { parsePortableSource } from "../lib/source-spec.mjs";
 const args = process.argv.slice(2);
 let cmd = args[0];
 const HELP_WORDS = new Set(["help", "--help", "-h"]);
-const KERNEL_COMMANDS = new Set(["prepare", "capture", "config", "create", "doctor", "inspect", "operation", "soul", "launch-config", "experimental", "onboard", "init", "inject", "install", "list", "migrate", "pane", "recall", "remove", "retire", "root", "schedule", "server", "session", "setup", "spawn", "status", "trust", "type", "update", "use", "version"]);
+const KERNEL_COMMANDS = new Set(["prepare", "capture", "config", "create", "doctor", "inspect", "operation", "soul", "launch-config", "experimental", "onboard", "init", "inject", "install", "list", "catalog", "migrate", "pane", "recall", "remove", "retire", "root", "schedule", "server", "session", "setup", "spawn", "status", "trust", "type", "update", "use", "version"]);
 const flag = (name) => {
   const i = args.indexOf(`--${name}`);
   return i >= 0 ? (args[i + 1] && !args[i + 1].startsWith("--") ? args[i + 1] : true) : undefined;
@@ -3059,6 +3059,20 @@ function renderMergeRegion(r) {
 }
 
 /** oats list — installed packages, exported capabilities, scopes. */
+/** `oats catalog [--json]` — the effective official package catalog, read-only.
+ *  Identity/discovery for consumers that cannot import the kernel (Desktop):
+ *  never acquires, never trusts, never fetches. */
+function catalogCmd() {
+  const described = describeOfficialCatalog();
+  if (JSON_MODE) { jsonOk(described); return; }
+  console.log(`Official package catalog (${described.catalog.origin}: ${shortPath(described.catalog.file)})`);
+  for (const p of described.packages) console.log(`  ${p.package}  ${p.url ?? "?"}@${p.ref ?? "?"}  path: ${p.path}`);
+  if (described.capabilityAliases.length) {
+    console.log("Capability aliases:");
+    for (const a of described.capabilityAliases) console.log(`  ${a.capability} -> ${a.package}${a.capabilityInPackage !== a.capability ? ` (exports ${a.capabilityInPackage})` : ""}${a.available ? "" : "  [package not in catalog]"}`);
+  }
+  console.log("Catalog identity grants no executable trust; acquire with `oats install <package>` and approve separately.");
+}
 function listCmd() {
   const dir = dirFlag();
   // FAIL-CLOSED (maintainer finding 3): list RAISES on invalid locks — an
@@ -5159,6 +5173,7 @@ else if (cmd === "install") install();
 else if (cmd === "config") configCmd();
 else if (cmd === "trust") trust();
 else if (cmd === "list") listCmd();
+else if (cmd === "catalog") catalogCmd();
 else if (cmd === "remove") removeCmd();
 else if (cmd === "migrate") migrateCmd();
 else if (cmd === "root") console.log(resolve(new URL("..", import.meta.url).pathname));
@@ -5351,6 +5366,8 @@ Usage:
                                             report under error.details)
   oats list [--dir <d>] [--json]             installed packages, exported capabilities,
                                             scopes, trust state
+  oats catalog [--json]                      the effective official package catalog (read-only:
+                                               identity/discovery, no acquisition or trust)
   oats update <package> [<package>@<ref>]    transactional package update: temp fetch,
       [--to <ref>] [--dir <d>]              closure validation, diff, lock replace,
                                             all capability approvals invalidated; a

package/docs/capabilities.md

@@ -285,6 +285,7 @@ oats install ../my-package                                          # local path
 oats install oats.okf                                                # official catalog id
 oats install                     # bare: exact restore of this chain's locks
 oats list                        # installed packages, exported capabilities, scopes
+oats catalog [--json]            # the effective official catalog: packages, refs, aliases, acquire argv (0.24.6+; read-only)
 oats update <package>            # transactional re-resolve + diff + trust reset
 oats remove <package>            # refuses while config/dependents reference it
 oats migrate [--dry-run]         # map v1 capability locks to package locks

package/docs/design/2026-09-20-redesign-program-board.md

@@ -2,7 +2,7 @@
 
 **Purpose:** the one accurate view of every work stream in the redesign, what is on main, what is in flight, who owns it, and what blocks it. Lead: `oats-expert` (redesign lead). Updated whenever anything merges, is returned, or reality changes. Older per-lane boards are superseded by this file.
 
-**Last update:** 2026-09-21 23:40Z · main `cd3d4913`+ · **oats-knowledge main `7148a36` = centralised base (58 concepts)** · OATS v0.24.4 · OKF v2.1.2 · aweb v1.11.2 · framework v1.1.3 · imports @ `7416d84e`
+**Last update:** 2026-09-22 07:00Z · main `508c4b5f`+ · **OATS v0.24.6 cutting** (PR45 slice 1a + `oats catalog`) · S8 slice 1b next
 
 Legend: ✅ on main/published · 🔄 in flight (PR/branch) · 🟡 preserved, not adopted · ⬜ not started · ⛔ blocked
 
@@ -17,7 +17,7 @@ Legend: ✅ on main/published · 🔄 in flight (PR/branch) · 🟡 preserved, n
 | S5 | Official marketplace = reviewed list in oats repo | ✅ D4 merged · ✅ `oats.framework` 1.1.1 listed (`oats.core`, `oats.setup`, `oats.knowledge-theory` aliases) | M | Desktop view → S8 |
 | S6 | Five expert souls created in the oats repo (`souls/<name>/`) | ✅ five + `oats-setup-expert` on main, all declaring `oats.core`, exported + imported | M, L, lead | legacy `agents/` cutover after S7 proof |
 | S7 | Centralised per-soul knowledge in `oats-knowledge` (migration + PR-only learning) | ✅ **MIGRATED — PR #2 merged → main `7148a36`, 58 concepts / 35k words from 399 legacy** (kernel 26, expert 18, desktop 13, assistant 1, market-research chartered empty); option A roster; theory + no-code-teaching rule; two workflow passes (24 agents) + lead review; validator 58/0/0; ownership 14/14 · ⏸ harvest OFF until new souls run from the base (human) | lead | next: legacy `agents/` decommission with the `~/OATS` cutover |
-| S8 | Desktop parity (marketplace view, soul creation with `oats.core`, onboarding flow) | ⬜ after D3 · **host offered: Juan's machine (has `claude`)** — accepted | fresh Desktop engineer on Juan's host | brief + spawn params after D3 |
+| S8 | Desktop parity with the redesign (Redesign v3, aweb palette, discovery-first control panel) | 🔄 **STARTED 2026-09-22**: existing `oats-desktop-engineer-1` retrofitted with an aweb identity (spawn hook replayed, `capabilityMeta` persisted, session reloaded); redesign artefacts copied into its home; brief sent (f16eed3f): merge main (0.24.5) first, then PR slices — shell/palette/sidebar → right panel follows selection → Souls view → **Capabilities view incl. official catalog (human's required feature; server-side via kernel catalog API, never auto-acquire/auto-trust)** → Knowledge/Tasks adapters → remainder. Lead reviews/merges each slice. **Decisions 2026-09-22:** human's later palette/row instructions supersede the HTML where they conflict; grouping is agent-group (cross-repo clusters), not repo; kernel seam `oats catalog --json` merged (PR46 `524180b7`, ships 0.24.6); the Juan-host fresh-engineer plan is superseded — this instance owns S8. | oats-desktop-engineer-1, lead | per-slice PRs | ✅ **Slice 1a MERGED `508c4b5f`** (PR45; 273/273 real jsdom; gates green) → v0.24.6. **Plan + seams recorded: [`docs/design/2026-09-22-desktop-parity-seams.md`](2026-09-22-desktop-parity-seams.md)** — slices 1a–8, seams K1–K8/P1, five policy decisions **DECIDED 2026-09-22 under delegation** — see `decisions/desktop-parity-lifecycle-and-policy-decisions.md`.
 
 ## S1 — Knowledge capability contract rework
 - ✅ Provider-neutral contract, binding wire v1, helper/input contract, retained execution: OATS 0.24.0 + OKF 2.1.0 (f20f8e57) published.
@@ -50,6 +50,10 @@ Fresh dir, local `@awebai/oats@0.24.1`, no prior state. `inspect --request` →
 - With `bindings-file`/`state-dir`/`harvest-runtime: pi` and the public `oats-knowledge` bound as base `oats`: **the knowledge slot binds** (OKF problem gone). `harvest-model` is optional per manifest; aweb 1.11.0 declares exactly one setting (`delivery`).
 - **aweb 1.11.0 is the only remaining hold** (`needs-configuration`, identical for `delivery: session` and `channel` on 0.24.2's unattributed output). No resolution publishes → OKF `check` probe not reachable yet. 0.24.3 run will show the attributed aweb message (expected: private-team binding / Pi session-input).
 
+## 0.24.5 — four small fixes, lead-implemented (2026-09-22, PR43 → `38b6c028`)
+
+Human authorised lead implementation after new spawns in the development deployment were blocked by a correct `pi-profile` drift refusal (profile pins bridge 0.23.2; global Pi has 0.24.0 — deployment policy, the human's re-pin). Merged: (1) retire recovery derives the branch from the worktree (drift recorded in `recovery.json`; detached HEAD recovers at its OID) — unblocks the three peers; (2) captured launch: `ifInstalled` rows satisfied by absence, hard rows refuse attributed (slot/capability/runtime/package/manifest `install`); (3) helper-injection refusal attributed; (4) `onboard --workspace` reads `package-catalog.json` from the workspace revision (bundled = fallback; `OATS_PACKAGE_CATALOG` = override; result `catalog.origin`; drift refusal names the lag). Full gate 1665/1661/0/4. Rule: `prepare` never ends in a bare `needs-configuration` after selection. Lesson: `lessons/pinned-release-lags-installed-release.md` (three lag refusals in one day). ✅ **v0.24.5 PUBLISHED** (npm both, GH release 7 assets, bump #44). ✅ **`~/OATS` re-onboarded clean on 0.24.5 with NO override**: `catalog.origin: workspace`, framework 1.1.3, setup expert from `7416d84e` — fix 4 proven the way a second operator meets it. ✅ **Three stuck peers retired by the normal path** (fix 1 proven live): each recovery records `branchDrift` (recorded vs worktree branch) and preserved home + untracked bytes + nested repos; L's recovery shows it had begun the 0.24.5 assignment on its own branch (superseded by PR43, preserved). Roster: only the lead and the Desktop engineer remain in the development deployment. Next: spawn the setup expert in `~/OATS` (human runs).
+
 ## Cutover started: `~/OATS` onboarded from the public workspace (lead, 2026-09-21 23:55Z)
 
 Kernel 0.24.4 installed globally; `oats onboard --dir ~/OATS --workspace git:github.com/awebai/oats` → `oats.framework` 1.1.3 acquired and exact-locked (lock v2), `oats.core` + `oats.setup` selected, `oats-setup-expert` copied from the workspace's pinned edition (`7416d84e`, workspace revision `c82a96af`), layers `none`. First attempt refused `integrity-drift` because the kernel's **bundled catalog snapshot** still listed framework 1.1.1 — correct refusal, misleading read; remedy `OATS_PACKAGE_CATALOG=<main's list>`; lesson `lessons/bundled-catalog-lags-the-reviewed-list.md` (proposes onboarding read the catalog from the workspace revision). Next: spawn the setup expert to adopt the workspace (knowledge → public `oats-knowledge` via OKF 2.1.2; messaging → aweb 1.11.2 or none) with explicit approvals; then the five expert souls run from the central base and this checkout becomes secondary. Harvest stays off until then.

package/docs/design/2026-09-22-desktop-parity-seams.md

@@ -0,0 +1,54 @@
+# Desktop parity — slice plan and kernel/provider seams (S8)
+
+Status: **proposal accepted for direction** by the lead on 2026-09-22; contracts K1–K8 and P1 are *proposed identifiers*, not shipped CLI grammar. Five policy decisions are routed to the human (below) before their slices start. Author of the plan: the Desktop engineer (`oats-desktop-engineer-1`); this document is the lead's record of it. Scope authority: the human's 2026-09-22 direction — the redesign to the letter, only frames 05 Knowledge and 06 Tasks excluded.
+
+## Slices (each a PR from main; lead reviews and merges)
+
+| Slice | Delivers | Needs |
+|---|---|---|
+| 1a | Compact guides; engine-owned ⌘F / ⌘N; rebind-aware hints | — (PR45) |
+| 1b | Shell 01a/01b: right panel Instance · Git & GitHub · Soul tabs, collapse rail, two editor groups, focus mode; panel state survives repaint | existing tabs/terminal lifecycle |
+| 2a | Worktree branch/ahead/behind/path; changes list; bounded unified diff | **K1** |
+| 2b | PR card: title/#/state/commits/closes; per-job checks bound to head OID; unresolved review threads; Open PR; Send threads | **P1**, **K2** |
+| 2c | Remove / Stop confirmations with worktree/branch/open-PR/child/dirty facts and receipts | **K3** |
+| 3 | 03 Souls + Sources: imported editions + local souls, requirements, provenance, editability | **K4** |
+| 4 | 04 Capabilities: official catalog (`oats catalog --json`, 0.24.6+) + deployment inventory/readiness/used-by; Add capability = exact command | landed catalog + list/inspect + **K5** |
+| 5 | 09 First-run readiness quartet; View policy; Skip/Enrol | **K5** + enrollment decision |
+| 6 | 02 Spawn (two-column): soul chooser, provider/model, launch config (restored), work-area naming/worktree/base+branch, opening instruction, attach knowledge, child spawns, auto-PR, readiness, ⌘↵ | **K6** (+ knowledge-node JSON from the knowledge provider; 05 excluded but attach stays) |
+| 7a | 07 Active overview: counts, relations, activity/waiting-on-you, actions, pan/zoom | **K7** |
+| 7b | 08 Schedules: table/toggles/new/edit, next/last, recent runs, transcript handoff, captured-policy preservation | **K8** |
+| 8 | 10 Components: dropdowns, workspace join/manage, Open in split, Detach to window, Open worktree in editor, actions, toasts, collapsed rail | existing seams + Desktop IPC review for detach/editor |
+
+## Shared JSON rules (accepted)
+
+Envelope `{schemaVersion:1, ok, result|error}` unchanged. Requests address a server-admitted exact target (`{home, server}` / exact source+revision+soul), never a renderer cwd. Results echo target + `contract`, `version`, `observedAt`, opaque `revision`, typed `problems[]`, explicit completeness/truncation. `null` = not known; empty = observed empty only when complete. Per-section availability `available | not-applicable | unavailable | denied | unsupported | error`. No stack traces, auth stderr, tokens or token-bearing URLs in renderer data. Remote paths are provenance, never local authority. Read-only calls never install, trust, enroll, spawn, fetch into the operator's worktree, switch branches or repair config.
+
+## Seams
+
+- **K1 `oats.instance-git` / `oats.instance-diff`** (kernel): typed per-instance Git state — worktree, head, upstream/merge-base comparison (missing upstream ≠ 0/0), NUL-delimited changes with rename paths and per-file counts; bounded unified diff by opaque file id + observation revision (stale selection refuses, never a different file). Replaces the Desktop-only `instance.git` aggregate whose fallback zeros can masquerade as clean.
+- **P1 `oats.instance-github`** (provider, not kernel): PR summary/checks/reviews through an additive Git/review **capability** with its own credential policy (native custody; Desktop never runs `gh`, reads tokens or opens credential forms). Needs a kernel dispatch contract for additive-capability structured views (today `operation run` accepts only knowledge/messaging/tasks). "No PR" ≠ unavailable ≠ unauthenticated ≠ rate-limited. Checks bind to exact head OID. Review markdown is untrusted text.
+- **K2 review-thread delivery**: explicit, confirmed send of selected threads to the exact home's session input with receipt (`delivered | refused | unknown`); delivered ≠ consumed. Typed producer events for commit / branch-renamed / PR-updated / review-request; **no prose parsing** to infer actions.
+- **K3 lifecycle plan/apply**: read-only plan (runtime activity, children, worktree dirt, branch + open PRs, retention per artefact, per-option allowed/default/reason, warnings, blockers) → apply with plan revision + idempotency key, revalidated under the lifecycle lock; per-target `completed | retained | partial | unknown`. Today there is **no standalone stop**, and retire removes owned worktrees; the design's default Remove retains worktree/branch/PR.
+- **K4 souls/sources enumeration**: qualified list of imported editions + authored local souls with identity/source/revision/requirements/declarations/editability; readiness separate from launchability and adoption; no renderer YAML.
+- **K5 readiness quartet**: `installed | trusted | configured | enrolled`, each `pass | fail | unknown | not-applicable` with items (subject, requiredness, reason, producer, evidence, remedy); trust separates artifact approval from `signature {verified|unsigned|unknown|invalid, signer}`; policy view returns **enforced** child-spawn/worktree permissions with origins; native config items report labels/scope state, never secrets; unknown ≠ granted.
+- **K6 spawn preview/apply**: kernel returns suggestions, canonical worktree/home/branch/base OID, resolved knowledge refs, enforced child policy, auto-PR policy, readiness, typed field problems; apply revalidates and captures; no Desktop-derived paths or branches.
+- **K7 activity feed**: bounded typed events per instance with provenance; "waiting on you" only from a producer that reports it.
+- **K8 schedule run history** + captured-policy-preserving edit contract; transcript access via the owning CLI/provider.
+
+## Decisions — DECIDED 2026-09-22 (lead, delegated by the human)
+
+Recorded in `agents/oats-expert/soul/knowledge/decisions/desktop-parity-lifecycle-and-policy-decisions.md`: (1) Remove retains worktree/branch/PR by default and re-homes the worktree to the deployment `worktrees/` root before the home is removed; (2) `stop` is a first-class recursive lifecycle route retaining everything for restart; (3) Enrol = workspace member admission with a two-document receipt; "signed by" renders only on a verified Git signature with a named signer; policy rows render enforced policy only; (4) child-spawn permission is enforced by the spawn route (attributed refusal); (5) auto-PR is provider-owned, default off, first pushed commit, draft, human undrafts. Gemini illustrative. The original questions follow for the record.
+
+### Original questions
+
+1. **Remove semantics** (K3, slice 2c): the design's default Remove deletes the instance but *retains* worktree, branch and remote PR; today retirement removes owned worktrees and there is no standalone Stop. Decide: adopt the design's retention default (needs a kernel placement/custody rule for a worktree that outlives its home) or keep current semantics and label the UI accordingly.
+2. **Recursive Stop** (K3): Stop as a first-class lifecycle action (retain home/worktree for restart) including children — new kernel route.
+3. **Enrollment** (K5, slice 5): what "Enrol workspace" *is* (workspace admission? team/machine registration?), its authority and receipt; `oats onboard` is bootstrap, not enrollment. Also what counts as **signature evidence** for "Trusted · signed by …" (catalog URL/hash is not a signer).
+4. **Enforced child-spawn permission** (K6): "Allow child spawns" must be enforced by admitted spawn routes, not advisory — new kernel policy surface.
+5. **Automatic PR** (K6 / P1): trigger (proposed: first non-empty *pushed* commit), draft status, publication consent; provider-owned; default off; never commits/pushes local data on its own.
+
+Also to confirm: prototype "Gemini" runtime is illustrative (not an OATS runtime) unless the human wants kernel work.
+
+## Ownership
+
+Lead: K1, K4, K5 (readiness/policy shape), K6 preview/apply plumbing, K7/K8 projections, dispatch contract for additive-capability views — proposed as Decisions where they change contracts, implemented in small PRs otherwise. P1: a new capability (`oats.git`/GitHub backend) — spec'd as a Decision with the human; implementation lane TBD. Desktop engineer: all slices, Desktop IPC review items (detach, open-in-editor).

package/docs/release-notes/v0.24.6.md

@@ -0,0 +1,9 @@
+# OATS v0.24.6 — `oats catalog` and the first Desktop parity slice
+
+Kernel/Pi/Desktop **0.24.6**. No contract, schema or authority change.
+
+- **`oats catalog [--json]`** — read-only description of the *effective* official package catalog: where it came from (`bundled` snapshot or `OATS_PACKAGE_CATALOG` override), every package with url/ref/payload root and the exact `oats install` argv, and the capability→package alias map with each alias's resolution. Identity and discovery only: nothing is acquired, trusted or fetched (the contract test asserts no filesystem writes). Built for the Desktop's Capabilities view, which cannot import the kernel; the notes in the payload state that catalog identity grants no executable trust and that a bundled catalog may lag later package releases. Aliases are mappings, not an export inventory.
+- **Desktop parity slice 1a** (`feat/desktop-sidebar-keyboard-parity`): compact relation guides in the roster (nesting 14→8px, elbows 7→4px, gutters 8→6px — the human's request for more horizontal room; rows stay 56px, three themes keep computed AA), engine-owned **⌘F** reveal-and-focus filter (un-hides the sidebar first) and **⌘N** explicit soul chooser (never auto-spawns), visible shortcut hints that follow user rebinds/unbinds. Renderer-only; terminal key passthrough and focus ownership unchanged.
+- **CI**: the pull-request workflow now checks out full history — the workspace-layout guard reads pinned import revisions with `git cat-file`, and a shallow clone made main red from `f34207e9` to `475ea9bf`.
+
+Direction for the rest of S8 is recorded in `docs/design/2026-09-22-desktop-parity-seams.md` (slices 1b–8; kernel seams K1–K8; provider seam P1) and the lifecycle/enrollment/permission/auto-PR decisions in the maintainer's knowledge base. Frames 05 Knowledge and 06 Tasks are excluded by direction.

package/lib/core.mjs

@@ -2143,6 +2143,24 @@ function readCatalogFile() {
 export function officialCapabilityAliases() {
   return readCatalogFile().capabilities;
 }
+/** Read-only description of the EFFECTIVE official catalog for consumers that
+ *  cannot import this module (the zero-dependency Desktop): where the list came
+ *  from, every package entry, every alias, and — per capability alias — the
+ *  resolved package. Identity and discovery only: nothing here acquires,
+ *  trusts or verifies; the exact acquire argv is data the operator runs. */
+export function describeOfficialCatalog() {
+  const { packages, capabilities, file } = readCatalogFile();
+  const origin = process.env.OATS_PACKAGE_CATALOG ? "override" : "bundled";
+  const entries = Object.entries(packages).map(([id, e]) => ({ package: id, url: e?.url ?? null, ref: e?.ref ?? null, path: e?.path ?? DEFAULT_PACKAGE_PATH,
+    acquire: { argv: ["oats", "install", id] } }));
+  const aliases = Object.entries(capabilities).map(([capability, target]) => {
+    const resolved = officialCapabilityPackage(capability, { aliases: capabilities });
+    return { capability, package: resolved.package, capabilityInPackage: resolved.migratedCapability, via: resolved.via, available: resolved.available };
+  });
+  return { schemaVersion: 1, catalog: { origin, file, kernelVersion: OATS_VERSION }, packages: entries, capabilityAliases: aliases,
+    notes: ["catalog identity grants no executable trust; acquisition verifies bytes and approval is a separate explicit step",
+      "a bundled catalog is a snapshot at this kernel's release and may lag later package releases; the reviewed list lives in the framework repository"] };
+}
 
 /** Which official package supplies a legacy (v1, `marketplace:`) capability.
  * Alias first, then identity (package id == capability id); `available` says

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.24.5",
+  "version": "0.24.6",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",