@awebai/oats 0.29.4 → 0.30.0

package/lib/workspace.mjs

@@ -17,6 +17,7 @@ import { oatsError } from "./errors.mjs";
 import * as defaultRemote from "./remote.mjs";
 import { bindRemote, classifyPackageValue, lockedPackageRef } from "./packages.mjs";
 import { manifestContractProblems } from "./capability-contract.mjs";
+import { BY_TEAM_REMOVED, TEAM_MEMBERSHIP_MOVED } from "./teams.mjs";
 
 /* ───────────────────────────── errors ─────────────────────────────────── */
 
@@ -163,10 +164,10 @@ const ABSOLUTE_PATH = /^(?:\/|\\\\|[A-Za-z]:[\\/])/;
 /** The workspace file's REF/PATH fields — the only values the absolute-path refusal applies to (contract §2,
  * Phase B: "absolute paths" means bare filesystem paths as VALUES that stand for a repo or a path inside one;
  * host state belongs in oats-local.yaml). Free text (`teams.*.description`) and the opaque provider payload
- * (`messaging`, incl. `byTeam.*`) are never scanned: a description may mention `/srv`, a provider may
+ * (`messaging`) are never scanned: a description may mention `/srv`, a provider may
  * legitimately carry a socket path or a URL, and neither is a place the kernel resolves.
- * → [[path, value]] for members[], packages.*, stores.*, external[].source|soul, defaults.<slot|capabilities>.*.from,
- *   defaults.byTeam.*.capabilities.*.from */
+ * → [[path, value]] for members[], packages.*, stores.*, external[].source|soul, defaults.<slot|capabilities>.*.from
+ */
 function* refFields(value) {
   if (Array.isArray(value.members)) for (let i = 0; i < value.members.length; i++) if (typeof value.members[i] === "string") yield [`/members/${i}`, value.members[i]];
   if (isObject(value.packages)) for (const [id, v] of Object.entries(value.packages)) if (typeof v === "string") yield [`/packages/${pointerKey(id)}`, v];
@@ -180,7 +181,6 @@ function* refFields(value) {
     const d = value.defaults;
     const froms = function* (caps, path) { if (isObject(caps)) for (const [name, choice] of Object.entries(caps)) if (isObject(choice) && typeof choice.from === "string") yield [`${path}/${pointerKey(name)}/from`, choice.from]; };
     for (const slot of ["knowledge", "messaging", "tasks", "capabilities"]) yield* froms(d[slot], `/defaults/${slot}`);
-    if (isObject(d.byTeam)) for (const [label, team] of Object.entries(d.byTeam)) yield* froms(team?.capabilities, `/defaults/byTeam/${pointerKey(label)}/capabilities`);
   }
 }
 function refKey(remote, ref) {
@@ -211,7 +211,6 @@ export function validateWorkspace(value, { remote = defaultRemote } = {}) {
     if (c.problem) { problems.push({ path: `/packages/${pointerKey(id)}`, message: `${c.problem} (a package is a bare version like v2.1.3 or git:<repo>@<ref>)` }); continue; }
     if (c.kind === "git") keyOrProblem(remote, c.repo, `/packages/${pointerKey(id)}`, problems);
   }
-  const teams = isObject(value.teams) ? Object.keys(value.teams) : [];
   if (Array.isArray(value.members)) {
     const seen = new Map();
     value.members.forEach((ref, i) => {
@@ -223,15 +222,8 @@ export function validateWorkspace(value, { remote = defaultRemote } = {}) {
     });
   }
   if (isObject(value.stores)) for (const [name, ref] of Object.entries(value.stores)) if (typeof ref === "string") keyOrProblem(remote, ref, `/stores/${pointerKey(name)}`, problems);
-  // Decision 23: messaging.byTeam addresses provider payload by team label — every label must be declared.
-  // `byTeam` is legal HERE only; nested inside a team's payload it would be a second, unmerged byTeam (M9).
-  if (isObject(value.messaging) && value.messaging.byTeam !== undefined) {
-    if (!isObject(value.messaging.byTeam)) problems.push({ path: "/messaging/byTeam", message: "must be an object of { <team label>: <payload> }" });
-    else for (const label of Object.keys(value.messaging.byTeam)) {
-      if (!teams.includes(label)) problems.push({ path: `/messaging/byTeam/${pointerKey(label)}`, message: `team ${show(label)} is not declared in teams` });
-      if (!isObject(value.messaging.byTeam[label])) problems.push({ path: `/messaging/byTeam/${pointerKey(label)}`, message: "must be an object (the payload for that team)" });
-      else reservedKeyProblems(value.messaging.byTeam[label], `/messaging/byTeam/${pointerKey(label)}`, problems);
-    }
+  if (isObject(value.messaging) && Object.hasOwn(value.messaging, "byTeam")) {
+    problems.push({ path: "/messaging/byTeam", reason: "removed-key", message: "messaging.byTeam was removed in 0.30: a team's provider id is teams.<label>.team (committed, shared) or oats-local.yaml teams.<label>.team (local)" });
   }
   if (Array.isArray(value.external)) value.external.forEach((entry, i) => {
     if (!isObject(entry)) return;
@@ -239,23 +231,35 @@ export function validateWorkspace(value, { remote = defaultRemote } = {}) {
       const at = entry.source.lastIndexOf("@");
       if (at > 0) keyOrProblem(remote, entry.source.slice(0, at), `/external/${i}/source`, problems);
     }
-    if (typeof entry.team === "string" && !teams.includes(entry.team)) problems.push({ path: `/external/${i}/team`, message: `team ${show(entry.team)} is not declared in teams` });
   });
   if (isObject(value.defaults)) {
     const d = value.defaults;
     for (const slot of ["knowledge", "messaging", "tasks", "capabilities"]) fromProblems(remote, d[slot], `/defaults/${slot}`, problems, { here: false });
-    if (isObject(d.byTeam)) for (const label of Object.keys(d.byTeam)) {
-      if (!teams.includes(label)) problems.push({ path: `/defaults/byTeam/${pointerKey(label)}`, message: `team ${show(label)} is not declared in teams` });
-      fromProblems(remote, d.byTeam[label]?.capabilities, `/defaults/byTeam/${pointerKey(label)}/capabilities`, problems, { here: false });
-    }
   }
-  return problems;
+  return withRemovedKeys(problems, value, REMOVED_KEYS.workspace);
+}
+export function validateMembership(value) { return withRemovedKeys(validateAgainst(schemaFor("membership"), value), value, REMOVED_KEYS.membership); }
+
+/** Keys 0.30 removed (team model v2): each is a schema problem naming its replacement, in place of
+ *  the schema's generic "unexpected property". `at(value)` → the JSON pointers where it appears. */
+const REMOVED_KEYS = {
+  workspace: [
+    { at: (v) => (isObject(v?.defaults) && Object.hasOwn(v.defaults, "byTeam") ? ["/defaults/byTeam"] : []), message: "defaults.byTeam was removed in 0.30: capabilities compose from defaults.capabilities and the soul only" },
+    { at: (v) => (Array.isArray(v?.external) ? v.external.flatMap((e, i) => (isObject(e) && Object.hasOwn(e, "team") ? [`/external/${i}/team`] : [])) : []), message: TEAM_MEMBERSHIP_MOVED },
+  ],
+  membership: [{ at: (v) => (isObject(v) && Object.hasOwn(v, "team") ? ["/team"] : []), message: TEAM_MEMBERSHIP_MOVED }],
+  soul: [{ at: (v) => (isObject(v) && Object.hasOwn(v, "team") ? ["/team"] : []), message: TEAM_MEMBERSHIP_MOVED }],
+};
+function withRemovedKeys(problems, value, removed) {
+  const found = removed.flatMap((r) => r.at(value).map((path) => ({ path, reason: "removed-key", message: r.message })));
+  if (!found.length) return problems;
+  const paths = new Set(found.map((p) => p.path));
+  return [...problems.filter((p) => !paths.has(p.path)), ...found];
 }
-export function validateMembership(value) { return validateAgainst(schemaFor("membership"), value); }
 /** Schema + domain problems for a soul.yaml value: `from:` values must be canonical (see fromProblems);
- * slot payloads may not carry the reserved `byTeam` key (see reservedKeyProblems). */
+ * slot payloads may not carry the removed `byTeam` key (see reservedKeyProblems). */
 export function validateSoul(value, { remote = defaultRemote } = {}) {
-  const problems = validateAgainst(schemaFor("soul"), value);
+  const problems = withRemovedKeys(validateAgainst(schemaFor("soul"), value), value, REMOVED_KEYS.soul);
   if (isObject(value) && value.schemaVersion === 2) {
     fromProblems(remote, value.capabilities, "/capabilities", problems, { here: true });
     for (const slot of ["knowledge", "messaging", "tasks"]) if (isObject(value[slot])) reservedKeyProblems(value[slot], `/${slot}`, problems);
@@ -263,15 +267,14 @@ export function validateSoul(value, { remote = defaultRemote } = {}) {
   return problems;
 }
 
-/** `byTeam` is RESERVED (decision 23): it addresses a per-team payload and is legal only at the top level
- * of workspace.messaging, where resolve merges base ⊕ byTeam[soul.team] and strips it. Anywhere else — a
- * soul's slot payload, oats-local.yaml settings[cap], a spawn provider, or nested inside a team's own
- * payload — it would reach the provider verbatim (or shadow the real one); refused as a schema problem
- * with `reason: "reserved-key"`. Only the payload's TOP level is checked: deeper keys are the provider's. */
-const RESERVED_PAYLOAD_KEY = "byTeam";
+/** `byTeam` was removed in 0.30 (team model v2): a per-team payload no longer exists — a team's
+ * provider id is teams.<label>.team. At the top level of any payload layer (a soul's slot payload,
+ * oats-local.yaml settings[cap], a spawn provider) it would reach the provider verbatim as a dead key;
+ * refused as a schema problem with `reason: "removed-key"`. Deeper keys are the provider's. */
+const REMOVED_PAYLOAD_KEY = "byTeam";
 function reservedKeyProblems(payload, path, problems) {
   if (!isObject(payload)) return;
-  if (Object.hasOwn(payload, RESERVED_PAYLOAD_KEY)) problems.push({ path: `${path}/${RESERVED_PAYLOAD_KEY}`, reason: "reserved-key", message: `${show(RESERVED_PAYLOAD_KEY)} is reserved: it is legal only at the top level of the workspace file's messaging: payload (decision 23)` });
+  if (Object.hasOwn(payload, REMOVED_PAYLOAD_KEY)) problems.push({ path: `${path}/${REMOVED_PAYLOAD_KEY}`, reason: "removed-key", message: BY_TEAM_REMOVED });
 }
 
 /** `from:` must be exactly what the resolver compares against — "package", "here" (souls only) or a CANONICAL
@@ -290,7 +293,7 @@ function fromProblems(remote, capabilities, path, problems, { here }) {
     if (key !== from) problems.push({ path: at, message: `${show(from)} is not a canonical repo key (expected <host>/<path> as parseRepoRef(...).key${key ? `, e.g. ${show(key)}` : ""}); \`here\`, \`package\` or a key are the only forms` });
   }
 }
-/** Schema + domain problems for an oats-local.yaml value: settings[<cap>] may not carry the reserved `byTeam` key. */
+/** Schema + domain problems for an oats-local.yaml value: settings[<cap>] may not carry the removed `byTeam` key. */
 export function validateLocal(value) {
   const problems = validateAgainst(schemaFor("local"), value);
   if (isObject(value) && isObject(value.settings)) for (const [cap, payload] of Object.entries(value.settings)) reservedKeyProblems(payload, `/settings/${pointerKey(cap)}`, problems);
@@ -345,7 +348,7 @@ function schemaError(kind, origin, problems, value) {
 
 /** What a 0.25 `oats-config.yaml` held, and where each piece lives now (0.26.0 removed the file). */
 export const LEGACY_CONFIG_MIGRATION = "oats-config.yaml is no longer read (removed in 0.26.0): launch-configs moved to the deployment's oats-local.yaml; "
-  + "capability bindings, layers and team moved to oats-workspace.yaml (defaults, teams) and each soul's soul.yaml in its member repository; "
+  + "capability bindings and layers moved to oats-workspace.yaml (defaults) and each soul's soul.yaml in its member repository, and team membership to the deployment's oats-local.yaml (`oats teams`, `oats soul teams`); "
   + "agents-md-injection, skill-overrides, work-modes and yolo are removed (yolo is --yolo or a launch configuration's yolo). Move what you still need, then delete the file";
 
 /** Walk up from dir to find oats-local.yaml → { path, local } | E_LOCAL_MISSING.
@@ -392,52 +395,11 @@ export async function observeWorkspace(ref, { at, remote: injected, remoteOption
   return { key: obs.key, url: obs.url, ref, commit: obs.commit, workspace: read.value, observedAt: obs.observedAt };
 }
 
-/**
- * A soul's team labels as its repository declares them NOW, without a workspace discovery (teams
- * contract decision 6, the live teams of an existing home): the workspace host has already been read
- * (`wsObs`, observeWorkspace); this reads the soul's own repo once — a member at its current commit
- * (`souls/<name>/soul.yaml`, and `oats-membership.yaml` only when the soul declares no `team`), or an
- * `external[]` soul at its pinned commit (its entry's `team` wins, as in discovery).
- * → labels (primary first), or null when the workspace no longer lists the soul's repo.
- * Membership is not re-confirmed here: the home's soul was confirmed at spawn; this reads labels only.
- */
-export async function observeSoulLabels(wsObs, { name, repoKey }, { remote: injected, remoteOptions } = {}) {
-  const remote = remoteOf({ remote: injected, remoteOptions });
-  const workspace = wsObs.workspace;
-  const readSoul = async (ref, commit, path) => {
-    const file = `${path.replace(/\/+$/, "")}/soul.yaml`;
-    const { bytes } = await remote.readRemoteFile(ref, commit, file);
-    const read = readDeclaration("soul", bytes, { kind: "soul", repoKey, commit, path: file });
-    if (read.problems) throw schemaError("soul", { kind: "soul", repoKey, commit, path: file }, read.problems, read.value);
-    return read.value;
-  };
-  for (const entry of workspace.external || []) {
-    const pin = entry.source.lastIndexOf("@");
-    let key; try { key = refKey(remote, entry.source.slice(0, pin)); } catch { continue; }
-    if (key !== repoKey) continue;
-    if (typeof entry.team === "string") return [entry.team];
-    const soul = await readSoul(entry.source.slice(0, pin), entry.source.slice(pin + 1), entry.soul);
-    if (soul.name !== name) continue;
-    return labelList(soul.team) ?? [];
-  }
-  const memberRef = (workspace.members || []).find((ref) => { try { return refKey(remote, ref) === repoKey; } catch { return false; } });
-  if (!memberRef) return null;
-  const obs = await remote.observeRemote(memberRef);
-  const soul = await readSoul(memberRef, obs.commit, `souls/${name}`);
-  const own = labelList(soul.team);
-  if (own) return own;
-  try {
-    const { bytes } = await remote.readRemoteFile(memberRef, obs.commit, "oats-membership.yaml");
-    const read = readDeclaration("membership", bytes, { kind: "membership", repoKey, commit: obs.commit, path: "oats-membership.yaml" });
-    return read.problems ? [] : labelList(read.value.team) ?? [];
-  } catch (e) { if (e?.code === "E_REMOTE_PATH_MISSING") return []; throw e; }
-}
-
 const unconfirmed = (key, reason, detail, extra = {}) => ({ key, confirmed: false, reason, detail, ...extra });
 
 /**
  * Read the member's oats-membership.yaml at its default branch in the same access context.
- * → { key, commit, confirmed: true, team } | { key, confirmed: false, reason, detail }
+ * → { key, commit, confirmed: true } | { key, confirmed: false, reason, detail }
  */
 export async function confirmMembership(workspaceObs, memberRef, { remote: injected, remoteOptions } = {}) {
   const remote = remoteOf({ remote: injected, remoteOptions });
@@ -481,35 +443,24 @@ export async function confirmMembership(workspaceObs, memberRef, { remote: injec
     const caseOnly = backlinkKey.toLowerCase() === workspaceObs.key.toLowerCase();
     return unconfirmed(key, "backlink-elsewhere", `${key}@${obs.commit.slice(0, 12)} names workspace ${backlinkKey}, not ${workspaceObs.key}${caseOnly ? " (the keys differ only by letter case: repo paths are case-sensitive identities; spell the workspace ref exactly as the workspace lists itself)" : ""}`, { commit: obs.commit, backlink: backlinkKey, ...(caseOnly ? { caseOnly: true } : {}) });
   }
-  const labels = labelList(read.value.team) ?? [];
-  return { key, commit: obs.commit, confirmed: true, team: labels[0] ?? null, labels };
+  return { key, commit: obs.commit, confirmed: true };
 }
 
 /* ───────────────────────────── enumeration ────────────────────────────── */
 
 const SOUL_FILE = /^([^/]+)\/soul\.yaml$/;
 const CAP_FILE = /^([^/]+)\/oats\.json$/;
-/** A declared `team` as a label list (teams contract 2026-09-25: a label or a non-empty list of distinct
- *  labels, the first the primary); null when the item declares none. */
-const labelList = (team) => (typeof team === "string" ? [team] : Array.isArray(team) ? team.filter((l) => typeof l === "string") : null);
-/** The item's labels, else the repo default's (oats-membership.yaml). */
-const labelsOf = (item, fallback) => labelList(item?.team) ?? [...(fallback || [])];
-/** Each label with the path it is declared at: `/team` for one label, `/team/<i>` in a list. */
-const labelPaths = (item, labels, file) => labels.map((label, i) => [label, Array.isArray(item?.team) ? `${file}#/team/${i}` : `${file}#/team`]);
 
 /**
  * Enumerate souls/*\/soul.yaml and capabilities/*\/oats.json of one repo at one commit.
  * Validates each item; collects problems instead of aborting.
  * → { souls: [SoulEntry], capabilities: [CapEntry], problems: [{ code, path, message, repoKey }] }
  */
-async function enumerateRepo(remote, ref, key, commit, { defaultLabels = [], teams = null } = {}) {
+async function enumerateRepo(remote, ref, key, commit) {
   const souls = [];
   const capabilities = [];
   const problems = [];
   const problem = (code, path, message) => problems.push({ code, repoKey: key, path, message });
-  const checkTeam = (team, path) => {
-    if (team !== null && teams && !teams.includes(team)) problem("E_TEAM_UNKNOWN", path, `team ${show(team)} is not declared in the workspace's teams (${teams.join(", ") || "none"})`);
-  };
   // A listing failure on one directory is a problem of THIS repo, never an abort of the whole picture.
   const list = async (dir) => {
     try { return await remote.listRemoteTree(ref, commit, dir, { depth: 2 }); }
@@ -533,10 +484,8 @@ async function enumerateRepo(remote, ref, key, commit, { defaultLabels = [], tea
     if (definition.name !== m[1]) problem("E_WORKSPACE_SCHEMA", `${file}#/name`, `soul name ${show(definition.name)} does not match its directory ${show(m[1])}`);
     if (soulNames.has(definition.name)) { problem("E_WORKSPACE_SCHEMA", `${file}#/name`, `soul name ${show(definition.name)} is already declared by ${soulNames.get(definition.name)}; the second declaration is not listed`); continue; }
     soulNames.set(definition.name, file);
-    const labels = labelsOf(definition, defaultLabels);
-    for (const [label, at] of labelPaths(definition, labels, file)) checkTeam(label, at);
     // Souls have no private mode since 0.26.0: `private` is accepted, warned (soul-private-ignored) and never hides a soul.
-    souls.push({ name: definition.name, path, repoKey: key, commit, team: labels[0] ?? null, labels, private: false, definition });
+    souls.push({ name: definition.name, path, repoKey: key, commit, private: false, definition });
   }
   const capNames = new Map();
   for (const entry of await list("capabilities")) {
@@ -559,7 +508,6 @@ async function enumerateRepo(remote, ref, key, commit, { defaultLabels = [], tea
         capability: { type: "string", pattern: "^[a-z0-9][a-z0-9._-]*$" },
         version: { type: "string", minLength: 1 },
         private: { type: "boolean" },
-        team: { type: "string", pattern: "^[a-z0-9][a-z0-9._-]*$" },
         layer: { enum: ["knowledge", "messaging", "tasks"] },
       },
     }, manifest);
@@ -569,10 +517,7 @@ async function enumerateRepo(remote, ref, key, commit, { defaultLabels = [], tea
     if (contract.length) { for (const p of contract) problem("E_WORKSPACE_SCHEMA", `${file}#${p.pointer}`, p.message); continue; }
     if (capNames.has(manifest.capability)) { problem("E_WORKSPACE_SCHEMA", `${file}#/capability`, `capability ${show(manifest.capability)} is already declared by ${capNames.get(manifest.capability)}; the second declaration is not listed`); continue; }
     capNames.set(manifest.capability, file);
-    // A capability is LISTED under one team (its own `team:`, else the repo default's primary); it joins none.
-    const team = typeof manifest.team === "string" ? manifest.team : defaultLabels[0] ?? null;
-    checkTeam(team, `${file}#/team`);
-    capabilities.push({ name: manifest.capability, path, repoKey: key, commit, team, private: manifest.private === true, manifest });
+    capabilities.push({ name: manifest.capability, path, repoKey: key, commit, private: manifest.private === true, manifest });
   }
   // Non-collapse rule: a member's oats-package/ is REPORTED (publishes), never enumerated as member capabilities.
   let publishes = null;
@@ -608,7 +553,7 @@ export async function discoverRepo(ref, { at, remote: injected, remoteOptions }
   } catch (e) {
     if (e?.code !== "E_REMOTE_PATH_MISSING") throw e;
   }
-  const items = await enumerateRepo(remote, ref, obs.key, obs.commit, { defaultLabels: labelList(membership?.team) ?? [], teams: null });
+  const items = await enumerateRepo(remote, ref, obs.key, obs.commit);
   return { key: obs.key, commit: obs.commit, membership, ...items, problems: [...problems, ...items.problems] };
 }
 
@@ -622,8 +567,8 @@ export function packageSoulAgentName(id, soul) { return `${String(id).replace(/[
 /**
  * Package souls (0.28.0): the souls the lock records for each package the workspace STILL declares,
  * read at the locked commit. A package soul is listed like a member soul, with its package origin
- * (`package`, `version`) and its qualified name `<package>/<soul>`; its labels are its soul.yaml's
- * own `team` (a package has no membership default) and each must be declared (E_TEAM_UNKNOWN).
+ * (`package`, `version`) and its qualified name `<package>/<soul>`. A package soul.yaml still carrying
+ * `team:` (removed in 0.30: team membership is local) is invalid and not listed.
  * Nothing here trusts the lock's digests — a spawn verifies the fetched soul against them.
  * `lock` null (or no workspace) → nothing. → { souls: [SoulEntry], problems }
  */
@@ -632,7 +577,6 @@ export async function discoverPackageSouls(workspace, lock, { remote: injected,
   if (!isObject(lock?.packages) || !isObject(workspace)) return { souls, problems };
   const remote = remoteOf({ remote: injected, remoteOptions });
   const declared = isObject(workspace.packages) ? workspace.packages : {};
-  const teams = isObject(workspace.teams) ? Object.keys(workspace.teams) : [];
   for (const id of Object.keys(lock.packages).sort()) {
     const entry = lock.packages[id];
     if (!Array.isArray(entry?.souls) || entry.souls.length === 0 || !Object.hasOwn(declared, id)) continue;
@@ -656,12 +600,8 @@ export async function discoverPackageSouls(workspace, lock, { remote: injected,
       if (read.problems) { for (const p of read.problems) problem("E_WORKSPACE_SCHEMA", `${file}#${p.path}`, `${p.message}${schemaHint("soul", read.value)}`); continue; }
       const definition = read.value;
       if (definition.name !== locked.name) { problem("E_WORKSPACE_SCHEMA", `${file}#/name`, `soul name ${show(definition.name)} does not match its directory ${show(locked.name)}`); continue; }
-      const labels = labelList(definition.team) ?? [];
-      for (const [label, where] of labelPaths(definition, labels, file)) {
-        if (!teams.includes(label)) problems.push({ code: "E_TEAM_UNKNOWN", repoKey: null, package: id, path: at(where), message: `team ${show(label)} is not declared in the workspace's teams (${teams.join(", ") || "none"}) — declare it in oats-workspace.yaml teams: to spawn ${id}/${locked.name}` });
-      }
       souls.push({
-        name: locked.name, path, repoKey: key, ref, commit: entry.commit, team: labels[0] ?? null, labels, private: false, definition,
+        name: locked.name, path, repoKey: key, ref, commit: entry.commit, private: false, definition,
         package: id, version: entry.version, qualifiedName: `${id}/${locked.name}`, agentName: packageSoulAgentName(id, locked.name), digest: locked.digest,
       });
     }
@@ -683,7 +623,7 @@ export async function discoverPackageSouls(workspace, lock, { remote: injected,
 
 /**
  * The whole picture in one access context.
- * → { workspace, members: [{ key, commit, confirmed, reason?, team, souls, capabilities, publishes }], external: [...],
+ * → { workspace, members: [{ key, commit, confirmed, reason?, souls, capabilities, publishes }], external: [...],
  *     problems: [{ code, path, message, repoKey? }] }
  * `publishes` = { package, version } when the member carries oats-package/oats-package.json (informational:
  * the package's capabilities are NOT member capabilities — non-collapse rule), else null.
@@ -692,12 +632,11 @@ export async function discoverWorkspace(ref, { at, local, lock = null, remote: i
   const remote = remoteOf({ remote: injected, remoteOptions });
   const wsObs = await observeWorkspace(ref, { at, remote });
   const workspace = wsObs.workspace;
-  const teams = isObject(workspace.teams) ? Object.keys(workspace.teams) : [];
   const problems = [];
   const members = [];
   for (const memberRef of workspace.members || []) {
     const confirmation = await confirmMembership(wsObs, memberRef, { remote });
-    const row = { key: confirmation.key, ref: memberRef, commit: confirmation.commit ?? null, confirmed: confirmation.confirmed, team: confirmation.team ?? null, labels: confirmation.labels ?? [], souls: [], capabilities: [], publishes: null };
+    const row = { key: confirmation.key, ref: memberRef, commit: confirmation.commit ?? null, confirmed: confirmation.confirmed, souls: [], capabilities: [], publishes: null };
     if (!confirmation.confirmed) {
       // Contract: an unconfirmed member contributes nothing but its row.
       row.reason = confirmation.reason;
@@ -705,10 +644,7 @@ export async function discoverWorkspace(ref, { at, local, lock = null, remote: i
       members.push(row);
       continue;
     }
-    for (const [i, label] of row.labels.entries()) {
-      if (!teams.includes(label)) problems.push({ code: "E_TEAM_UNKNOWN", repoKey: row.key, path: row.labels.length > 1 ? `oats-membership.yaml#/team/${i}` : "oats-membership.yaml#/team", message: `team ${show(label)} is not declared in the workspace's teams (${teams.join(", ") || "none"})` });
-    }
-    const items = await enumerateRepo(remote, memberRef, row.key, row.commit, { defaultLabels: row.labels, teams });
+    const items = await enumerateRepo(remote, memberRef, row.key, row.commit);
     row.souls = items.souls;
     row.capabilities = items.capabilities;
     row.publishes = items.publishes;
@@ -735,47 +671,18 @@ export async function discoverWorkspace(ref, { at, local, lock = null, remote: i
     }
     const read = readDeclaration("soul", bytes, { kind: "soul", repoKey: key, commit, path: file });
     if (read.problems) { for (const p of read.problems) pushProblem("E_WORKSPACE_SCHEMA", `${file}#${p.path}`, `${p.message}${schemaHint("soul", read.value)}`); continue; }
-    // The workspace's `external[].team` (one label) overrides the soul's own labels.
-    const labels = labelList(entry.team) ?? labelList(read.value.team) ?? [];
-    for (const label of labels) if (!teams.includes(label)) pushProblem("E_TEAM_UNKNOWN", `${file}#/team`, `team ${show(label)} is not declared in the workspace's teams`);
-    externalRows.push({ source: entry.source, key, commit, soul: { name: read.value.name, path: entry.soul, repoKey: key, commit, team: labels[0] ?? null, labels, private: false, definition: read.value } });
+    externalRows.push({ source: entry.source, key, commit, soul: { name: read.value.name, path: entry.soul, repoKey: key, commit, private: false, definition: read.value } });
   }
   const pkg = await discoverPackageSouls(workspace, lock, { remote });
   problems.push(...pkg.problems);
-  return { workspace, key: wsObs.key, url: wsObs.url, commit: wsObs.commit, observedAt: wsObs.observedAt, local: local ?? null, members, external: externalRows, packageSouls: pkg.souls, problems, warnings: workspaceWarnings(workspace, members, externalRows, pkg.souls, teams) };
-}
-
-/** The discovery's warnings: unmapped team labels and ignored `private:`, over every listed soul. */
-export function workspaceWarnings(workspace, members, externalRows, packageSouls, teams = isObject(workspace?.teams) ? Object.keys(workspace.teams) : []) {
-  const extra = (packageSouls || []).map((soul) => ({ soul }));
-  return [...unmappedLabelWarnings(workspace, members, [...externalRows, ...extra], teams), ...privateSoulWarnings([...members.filter((m) => m.confirmed).flatMap((m) => m.souls), ...externalRows.map((e) => e.soul), ...(packageSouls || [])])];
+  return { workspace, key: wsObs.key, url: wsObs.url, commit: wsObs.commit, observedAt: wsObs.observedAt, local: local ?? null, members, external: externalRows, packageSouls: pkg.souls, problems, warnings: workspaceWarnings(workspace, members, externalRows, pkg.souls) };
 }
 
-/** Teams contract decision 5: a soul label the workspace declares in `teams:` but does not map in
- *  `messaging.byTeam` is a WARNING, not a problem — the label stays eligible-but-unmapped and the
- *  messaging provider falls back to the workspace's default team for it. (An undeclared label is E_TEAM_UNKNOWN.)
- *  ONE warning per unmapped label, naming its souls (a workspace on its default team alone would otherwise print
- *  a line per soul): { code, label, souls, paths, message }, sorted by label. */
+/** The discovery's warnings: ignored `private:`, over every listed soul. (0.30 removed the
+ *  `unmapped-team-label` warning: an unmapped shared team is the readiness item `team-unmapped`.) */
 const byCodepointOrder = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
-function unmappedLabelWarnings(workspace, members, externalRows, teams) {
-  const byTeam = isObject(workspace?.messaging) && isObject(workspace.messaging.byTeam) ? workspace.messaging.byTeam : {};
-  const byLabel = new Map();
-  const souls = [...members.filter((m) => m.confirmed).flatMap((m) => m.souls), ...externalRows.map((e) => e.soul)];
-  for (const soul of souls) {
-    for (const label of soul.labels || []) {
-      if (!teams.includes(label) || Object.hasOwn(byTeam, label)) continue;
-      const row = byLabel.get(label) || { souls: [], paths: [] };
-      row.souls.push(soul.name); row.paths.push(`${soul.repoKey}:${soul.path}/soul.yaml#/team`);
-      byLabel.set(label, row);
-    }
-  }
-  return [...byLabel.keys()].sort(byCodepointOrder).map((label) => {
-    const { souls: names, paths } = byLabel.get(label);
-    const order = names.map((n, i) => i).sort((x, y) => byCodepointOrder(names[x], names[y]) || byCodepointOrder(paths[x], paths[y]));
-    const sorted = order.map((i) => names[i]);
-    return { code: "unmapped-team-label", label, souls: sorted, paths: order.map((i) => paths[i]),
-      message: `team ${show(label)} has no messaging.byTeam entry; its souls (${sorted.join(", ")}) fall back to the workspace's default team for it` };
-  });
+export function workspaceWarnings(workspace, members, externalRows, packageSouls) {
+  return privateSoulWarnings([...members.filter((m) => m.confirmed).flatMap((m) => m.souls), ...externalRows.map((e) => e.soul), ...(packageSouls || [])]);
 }
 
 /** `private:` in a soul.yaml has no effect since 0.26.0 (human decision 2026-09-25): every soul of a
@@ -837,7 +744,7 @@ export function standaloneRepo(ref, commit, discovery, { remote: injected } = {}
   });
   return {
     standalone: true, key, commit: source.commit ?? commit ?? null, workspace: null,
-    members: [{ key, commit: source.commit ?? commit ?? null, confirmed: false, reason: "cannot-read", detail: `workspace of ${key} cannot be read; standalone view`, team: source.team ?? labelList(source.membership?.team)?.[0] ?? null, souls, capabilities, publishes: source.publishes ?? null }],
+    members: [{ key, commit: source.commit ?? commit ?? null, confirmed: false, reason: "cannot-read", detail: `workspace of ${key} cannot be read; standalone view`, souls, capabilities, publishes: source.publishes ?? null }],
     external: [], problems, warnings: privateSoulWarnings(souls),
   };
 }

package/package-catalog.json

@@ -3,12 +3,12 @@
   "packages": {
     "oats.okf": {
       "url": "https://github.com/awebai/oats-okf.git",
-      "ref": "v4.0.1",
+      "ref": "v4.0.4",
       "path": "oats-package"
     },
     "oats.aweb": {
       "url": "https://github.com/awebai/oats-aweb.git",
-      "ref": "v1.16.0",
+      "ref": "v1.17.1",
       "path": "oats-package"
     },
     "oats.jira": {
@@ -26,19 +26,18 @@
       "ref": "v1.0.3",
       "path": "oats-package"
     },
-    "oats.dev": {
-      "url": "https://github.com/awebai/oats-dev.git",
+    "oats.engineering": {
+      "url": "https://github.com/awebai/oats-engineering.git",
       "ref": "v1.1.0",
       "path": "oats-package"
     },
     "oats.framework": {
       "url": "https://github.com/awebai/oats.git",
-      "ref": "oats-framework/v1.3.2",
+      "ref": "oats-framework/v1.4.0",
       "path": "oats-package"
     }
   },
   "capabilities": {
-    "oats.review": "oats.dev",
     "oas.okf": {
       "package": "oats.okf",
       "capability": "oats.okf"
@@ -59,18 +58,13 @@
       "package": "oats.authoring",
       "capability": "oats.authoring"
     },
-    "oas.dev": {
-      "package": "oats.dev",
-      "capability": "oats.dev"
-    },
-    "oas.review": {
-      "package": "oats.dev",
-      "capability": "oats.review"
-    },
     "oats.knowledge-theory": "oats.framework",
     "oats.core": "oats.framework",
     "oats.setup": "oats.framework",
     "oats.okf-harvest": "oats.okf",
-    "oats.okf-maintenance": "oats.okf"
+    "oats.okf-maintenance": "oats.okf",
+    "oats.engineering-expert": "oats.engineering",
+    "oats.developer": "oats.engineering",
+    "oats.code-review": "oats.engineering"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.29.4",
+  "version": "0.30.0",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",

package/skills/oats-getting-started/SKILL.md

@@ -60,10 +60,8 @@ members:
   - git:github.com/acme/agents          # the host is a member too
   - git:github.com/acme/platform
 packages:
-  oats.framework: v1.1.3                # bare versions resolve through the official catalog
-  oats.okf: v2.1.5
-teams:
-  global: { description: Org-wide souls }
+  oats.framework: v1.4.0                # bare versions resolve through the official catalog
+  oats.okf: v4.0.4
 defaults:
   capabilities: { oats.core: { from: package } }
   knowledge: { oats.okf: { from: package } }
@@ -72,7 +70,7 @@ defaults:
 Take the current package versions from the official catalog
 (`package-catalog.json` in the OATS repository); ask which slots the user wants
 filled (knowledge, messaging, tasks) instead of copying the example. No absolute
-paths, accounts or team ids go in this file.
+paths or accounts go in this file. Teams come with messaging (step 6).
 
 Declaring a package in `packages:` is the decision to trust it: its commands
 and hooks run on every machine that spawns a soul using it. Show the user what
@@ -84,7 +82,6 @@ In **every** member repository, including the host, `oats-membership.yaml`:
 ```yaml
 schemaVersion: 2
 workspace: git:github.com/acme/agents
-team: global
 ```
 
 Membership is reciprocal: the workspace lists the repository and the
@@ -135,20 +132,35 @@ each package to an exact commit and integrity, and content that no longer
 matches is refused (`E_PACKAGE_INTEGRITY`). Member capabilities come from
 membership.
 
-## 6. Spawn the first soul
+## 6. Give the deployment a team (with messaging)
+
+If a messaging capability fills the messaging slot, every instance lives in a
+team, and readiness fails with `E_TEAM_UNCONFIGURED` until this deployment has
+a default team. Create the team with the messaging provider (its own skills say
+how), then record it:
+
+```bash
+oats teams add research --team <provider team id>   # a local team; the first one becomes the default
+oats teams
+```
+
+A team the whole organisation uses is committed in `oats-workspace.yaml` as
+`teams.<label>` with its provider id; which souls join which team on this
+machine is `oats soul teams` (`/oats-teams`, in `oats.setup`).
+
+## 7. Spawn the first soul
 
 A soul with `work: worktree | checkout` needs a clone of its repository at
 `<dir>/<repo name>` (or named in `oats-local.yaml` `clones:`).
 
 ```bash
-oats souls --dir <dir>                                  # what the workspace offers, with origin and team
+oats souls --dir <dir>                                  # what the workspace offers, with origin and teams
 oats spawn backend-expert --preview                     # modules, commits, merged provider settings — nothing created
 oats spawn backend-expert --task "First concrete task"
 oats status
 ```
 
-Create and spawn only when asked. After the first spawn, load the `oats.setup`
-skills for the rest of the deployment (messaging, more souls, rebuilds). For
-custom capabilities and integrations, use `integration-authoring`; for deep
-architecture questions or bugs, use `oats-support`. The model in full is
-`docs/workspaces.md` in the OATS repository.
+Create and spawn only when asked. After the first spawn, the `oats.setup`
+skills carry the rest of the deployment (messaging, more souls, rebuilds); the
+`oats.authoring` package teaches writing capabilities, skills and souls. The
+model in full is `docs/workspaces.md` in the OATS repository.

package/capabilities/oats-review/injects/review.md

@@ -1,69 +0,0 @@
-## Review discipline: oats.review
-
-**After every substantive commit, launch the reviewer** — and, when a knowledge
-layer is active, run its promotion step alongside (whatever command that layer
-documents; omit the line entirely if you have no knowledge layer):
-
-```bash
-<your knowledge layer's promotion command>   # omit when no knowledge layer is active
-oats spawn reviewer --work attached --work-dir "$PWD/work" \
-  --purpose "<short-sha>" \
-  --task "Review commit <sha> on branch <branch>. Report to <your-instance> per your operating loop."
-```
-
-- `reviewer` is the oats.dev package's soul (`oats.dev/reviewer`).
-  `--purpose "<short-sha>"` gives it a unique, commit-relevant instance name
-  (`oats-dev-reviewer-<short-sha>`); attached mode shares your work tree
-  and automatically makes the reviewer your child (attached agents are always
-  children of the work-tree owner — no relation flags needed or allowed).
-- The reviewer reviews **that commit's diff only** and reports its verdict
-  (`APPROVE` / `APPROVE WITH NITS` / `NEEDS CHANGES`) back to you the way your
-  deployment delivers messages: over your messaging layer when one is active,
-  and otherwise in its own session transcript, which is where you read it.
-  When a messaging layer IS active, do not wait actively — finish your turn and
-  go idle; the layer wakes you when the verdict arrives. `NEEDS CHANGES` means
-  fix, commit, and re-review before the work is ready.
-- Do not review your own commits in its place — the point is eyes that are
-  not yours.
-- Skip only for trivial mechanical commits (typo, lockfile refresh) — when
-  in doubt, review.
-
-## Delivery discipline (all OATS developers)
-
-- You work in a dedicated worktree on your own branch. **Main only moves
-  through PRs** — never push to main.
-- **Single-developer features**: branch from main (`agents/<instance>` or as
-  tasked), open the PR yourself (`gh pr create`) when review-clean, then
-  **spawn a fresh maintainer instance for it** — one per PR, always, even if
-  another oats-expert instance is live:
-
-  ```bash
-  oats spawn oats-expert --purpose "pr<n>" --relation parent --relative-to "$OATS_INSTANCE" \
-    --task "Maintainer review of PR #<n>: run your pr-review gates. You own this PR to its terminal outcome — on RETURN stay alive and idle for my fix notice, re-review, repeat; on merge/close record the delivery in your stewardship knowledge and retire yourself. Report verdicts to <your-instance>."
-  ```
-
-  Go idle for the verdict. **The maintainer instance stays alive across
-  RETURN rounds** — when you push fixes, notify the SAME maintainer, continuing
-  the existing exchange rather than starting a new one; do not spawn another for
-  this PR. You never merge to main
-  yourself.
-
-  **Reviewers are the opposite: one per commit, then gone.** The post-commit
-  reviewer reviews its one diff, reports its verdict, and retires — it no
-  longer exists when you fix its findings. To re-review a fix, spawn a NEW
-  reviewer on the fix commit (`--purpose <new-short-sha>`); never message a
-  retired reviewer or expect it to follow up.
-- **Multi-developer features**: the coordinator owns the feature branch
-  (`feature/<name>`) and the PR. Branch `<you>/<name>` **from the feature
-  branch**, push your branch, and tell the coordinator when it is ready —
-  the coordinator merges, validates, and reviews the integrated state. Never
-  merge into the feature branch yourself.
-- **If you need another developer's unmerged code, ask the coordinator** —
-  never fetch or merge a peer's branch yourself. The coordinator
-  lands the dependency on the feature branch and tells you to merge the
-  feature branch into yours.
-- Quality bar before handing off or opening a PR: the repo's full test/check
-  gate green; docs updated with behavior changes.
-- While waiting on the reviewer, the coordinator, or a peer: **do not sleep,
-  poll, or busy-wait** — go idle. An active messaging layer wakes you when the
-  answer arrives; with none, read the reviewer's own session when it finishes.

package/capabilities/oats-review/oats.json

@@ -1,10 +0,0 @@
-{
-  "capability": "oats.review",
-  "private": true,
-  "version": "1.3.0",
-  "compatibility": { "oats": ">=0.28.0" },
-  "description": "Post-commit review discipline: a fresh reviewer (this package's soul `reviewer`) reviews each new commit's diff, reports its verdict to its spawner over the deployment's messaging layer (or in its transcript when there is none), and retires — plus the shared developer delivery discipline and the reviewer's code-review and security-review skills.",
-  "requires": [],
-  "skills": ["skills/code-review", "skills/security-review"],
-  "inject": "injects/review.md"
-}